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Chairman,  Subcommittee  on  International  Security, 

Proliferation,  and  Federal  Services 
Committee  on  Governmental  Affairs 
United  States  Senate 

Dear  Mr.  Chairman: 

In  January  1996,  the  executive  branch  revised  controls  on  the  export  of 
U.S.-manufactxu-ed  high  performance  computers  (hpc)  by  raising 
thresholds  of  computer  performance  for  which  exporters  must  obtain  a 
license.  Subsequently,  several  unlicensed  hpcs  were  exported  to  both 
China  and  Russia,  including  17  computers  illegally  sent  to  a  Russian 
nuclear  weapons  lab.  You  expressed  concerns  that  U.S.  national  security 
interests  may  have  been  compromised  by  such  sales^  and  requested  that 
we  (1)  assess  the  basis  for  the  executive  branch’s  revision  of  hpc  export 
controls  and  (2)  identify  changes  in  licensing  activities  and  the 
implementation  of  certain  U.S.  licensing  and  export  enforcement 
requirements  since  the  revision.  You  also  asked  us  to  determine  the 
current  foreign  availability  of  hpcs,  particularly  for  certain  countries  of 
national  security  concern. 

We  are  also  issuing  a  related  report  entitled.  Export  Controls:  National 
Security  Issues  and  Foreign  Availability  for  High  Performance  Computers 
(gao/nsiai)-98-200.  Sept.  16, 1998),  pursuant  to  section  1214  of  the  Fiscal  Year 
1998  National  Defense  Authorization  Act  (P.L.  105-85). 


Background 


The  U.S.  export  control  system  is  about  managing  risk;  exports  to  some 
countries  involve  less  risk  than  to  other  countries  and  exports  of  some 
items  involve  less  risk  than  others.  Under  U.S.  law,  the  President  has  the 
authority  to  control  and  require  licenses  for  the  export  of  items  that  may 
pose  a  national  security  or  foreign  policy  concern.  The  President  also  has 
the  authority  to  remove  or  revise  those  controls  as  U.S.  concerns  and 


^The  circumstances  surrounding  these  specific  exports  are  being  investigated  by  the  U.S.  Departments 
of  Justice  and  Commerce  and  the  Customs  Service.  On  July  31, 1998,  the  Department  of  Justice 
announced  that  IBM  East  Europe/Asia  Ltd.  entered  a  guilty  plea  and  received  the  maximum  allowable 
fine  of  $8.5  million  for  violating  17  counts  of  U.S.  export  laws. 
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interests  change.^  In  doing  so,  the  President  is  not  required  imder  U.S.  law 
to  conduct  a  foreign  availability  analysis. 

In  1995,  as  a  continuation  of  changes  begun  in  the  1980s,  the  executive 
branch  reviewed  export  controls  on  computer  exports  to  determine  how 
changes  in  computer  technology  and  its  military  applications  should  affect 
U.S.  export  control  regulations.  In  announcing  its  January  1996  change  to 
HPC  controls,  the  executive  branch  stated  that  one  goal  of  the  revised 
export  controls  was  to  permit  the  government  to  tailor  control  levels  and 
licensing  conditions  to  the  national  security  or  proliferation  risk  posed  at  a 
specific  destination. 

A  key  element  of  the  executive  branch  review  of  hpc  export  controls  was  a 
Stanford  University  study,  jointly  commissioned  by  the  Commerce  and 
Defense  Departments.®  Among  other  things,  the  study  was  tasked  to 
provide  an  assessment  of  the  availability  of  hpcs  in  selected  countries  and 
the  capabilities  of  those  countries  to  use  hpcs  for  military  and  other 
national  security  applications.  The  study  concluded  that 
(1)  U.S.-manufactured  computer  technology  between  4,000  and 
5,000  millions  of  theoretical  operations  per  second  (mtops)^  was  widely 
available  and  uncontrollable  worldwide,  (2)  U.S.-manufactured  computer 
technology  up  to  7,000  mtops  would  become  widely  available  and 
uncontroUable  worldwide  by  1997,  and  (3)  many  hpc  applications  used  in 
U.S.  national  secinity  programs  occur  at  about  7,000  mtops  and  at  or  above 
10,000  MTOPS.  The  study  also  concluded  that  it  would  be  too  expensive  for 
government  and  industry  to  effectively  control  the  international  diffusion 
of  computing  systems  with  performance  below  7,000  mtops,  and  that 
attempts  to  control  computer  exports  below  this  level  would  become 
increasingly  ineffectual,  would  harm  the  credibility  of  export  controls,  and 
would  unreasonably  burden  a  vital  sector  of  the  computer  industry.  The 


%» this  report,  revision  of  export  controls  refers  to  removal  of  licensing  requirements  for  groups  of 
countries  based  on  the  performance  levels  of  HPCs. 

^Building  on  the  Basics:  An  Examination  of  High-Performance  Computing  Export  Control  Policy  in  the 
1990’s,  Seymour  Goodman,  Peter  Wolcott,  and  Grey  Burkhart  (Center  for  International  Security  and 
Arms  Control,  Stanford  University,  November  1995). 

^MTOPS  is  the  composite  theoretical  performance  of  a  computer  measured  in  millions  of  theoretical 
operations  per  second.  In  principle,  higher  MTOPS  indicates  greater  raw  performance  of  a  computer  to 
solve  computations  quickly,  but  not  the  actual  performance  of  a  given  machine  for  a  given  application. 
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Study  also  raised  concerns  about  llie  ability  to  control  hpc  exports  in  the 
future  in  light  of  advances  in  computing  technology.® 

The  export  control  policy  implemented  in  January  1996  removed  license 
requirements  for  most  hpc  exports  with  performance  levels  up  to 
2,000  MTOPS — an  increase  from  the  previous  level  of  1,500  mtops.  The 
policy  also  organized  countries  into  four  “computer  tiers,”  with  each  tier 
after  tier  1  representing  a  successively  higher  level  of  concern  to  U.S. 
security  interests.  The  policy  placed  no  license  requirements  on  tier  1 
countries,  primarily  those  in  Western  Europe  and  Japan.  Exports  of  hpcs 
above  10,000  mtoi»s  to  tier  2  countries  in  Asia,  Africa,  Latin  America,  and 
Central  and  Eastern  Europe  would  continue  to  require  licenses.  A 
dual-control  system  was  established  for  tier  3  countries,  such  as  Russia 
and  China.  For  these  countries,  hpcs  up  to  7,000  mtops  could  be  exported 
to  civilian  end  users  without  a  license,  while  exports  at  and  above  2,000 
MTOPS  to  end  users  of  concern  for  military  or  proliferation  of  weapons  of 
mass  destruction  reasons  required  a  license.  Exports  of  hpcs  above  7,000 
MTOPS  to  civilian  end  users  also  required  a  license,  hpc  exports  to  terrorist 
countries  in  tier  4  were  essentially  prohibited.  (See  appendix  n  for  details 
on  the  four-tier  system  of  export  controls.) 

The  January  1996  regulation  also  made  other  changes.  It  specified  that 
exporters  would  be  responsible  for  (1)  determining  whether  an  export 
license  is  required,  based  on  the  mtops  level  of  the  computer;  (2)  screeiung 
end  users  and  end  uses  for  military  or  proliferation  concerns;®  and 
(3)  keeping  records  and  reporting  on  exports  of  computers  with 
performance  levels  of  2,000  mtops.  In  addition  to  the  standard 
record-keeping  requirements,  the  regulation  added  requirements  for  the 
date  of  the  shipment,  the  name  and  address  of  the  end  user  and  of  each 
intermediate  consignee,  and  the  end  use  of  each  exported  computer.  The 
Fiscal  Year  1998  National  Defense  Authorization  Act  (P.L. 

105-85)  modified  the  pohcy  for  determining  whether  an  individual  license 
is  required  and  now  requires  exporters  to  notify  the  Commerce 
Department  of  any  planned  sales  of  computers  with  performance  levels 


^In  April  1998,  authors  of  the  1995  Stanford  study  published  a  follow-on  discussion  paper, 
High-performance  Computing,  National  Security  Applications,  and  Export  Control  Policy  at  the  Close 
of  the  20th  Century,  as  a  contribution  to  the  periodic  review  of  HPC  e^^ort  controls.  This  paper  noted 
(1)  that  rapid  advances  in  computer  technology  were  continuing  but  (2)  that  a  proposed  change  in 
licensing  procedure — ^to  review  each  HPC  at  its  highest  attainable  level,  rather  than  its  configuration  at 
time  of  export— would  remove  the  concern  of  HPCs  being  upgraded  without  the  knowledge  of 
exporters  or  the  U.S.  government.  We  did  not  evaluate  the  adequacy  of  the  analysis  and  support  of  the 
second  study. 

®End-use  screening  is  the  process  exporters  follow  to  evaluate  whether  a  transaction  involves  an 
unacceptable  risk  of  use  in,  or  diversion  to,  a  proliferator  or  military  end  user. 
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greater  than  2,000  mtops  to  tier  3  countries.  The  government  has  10  days  to 
assess  and  object  to  a  proposed  hpc  sale.  The  law  also  now  reqviires 
Commerce  to  perform  post-shipment  verifications  (psv)  on  all  hpc  e3q)orts 
with  performance  levels  over  2,000  mtops  to  tier  3  coxmtries.^  The 
Commerce  Department  promulgated  regulations  implementing  the  law  on 
February  3, 1998. 


Results  in  Brief 


The  Stanford  University  study  was  a  key  element  in  the  decision  to  revise 
HPC  export  controls.  However,  our  analysis  of  the  study  showed  that  it  had 
two  significant  limitations.  First,  the  study  lacked  empirical  evidence  or 
analysis  to  support  its  conclusion  that  hpcs  were  uncontrollable  based  on 
(1)  worldwide  availability  and  (2)  insufficient  resources  to  control  them. 
Second,  the  study  did  not  assess  the  capabilities  of  coimtries  of  concern  to 
use  HPCS  for  military  and  other  national  secmity  applications,  as  required 
by  its  tasking.  The  study’s  principal  author  said  that  U.S.  government  data 
was  insufficient  to  make  such  an  assessment,  and  the  study  recommended 
that  better  data  be  gathered  so  that  such  an  analysis  could  be  done  in  the 
future.  In  addition,  the  executive  branch  did  not  undertake  a  threat 
analysis  of  providing  hpcs  to  countries  of  concern.  Nonetheless,  based  on 
its  undocumented  view  of  the  worldwide  availability  of  computing  power 
and  on  the  technological  advancements  in  this  area,  the  executive  branch 
raised  the  mtops  thresholds  for  hpc  export  controls  and  established  the 
four-tier  control  structure.  Although  the  Stanford  study  had  limitations,  it 
made  some  observations  regarding  the  potential  to  upgrade  hpcs  and  the 
export  control  challenge  this  will  present  in  the  future.  For  example,  it 
noted  that  the  technological  trend  toward  upgrading  computer 
performance  without  vendor  support  or  knowledge  is  reducing  the 
effectiveness  of  U.S.  export  controls. 

The  1996  revision  to  hpc  export  controls  had  three  key  consequences. 

First,  the  number  of  computer  export  licenses  issued  declined  from  395  in 
fiscal  year  1995  to  42  in  1997.  Second,  U.S.  hpc  exporters  were  charged 
with  responsibilities  previously  conducted  by  the  government.  New  U.S. 
HPC  exporters’  responsibilities  included  screening  and  reporting  on  the  end 
use  and  end  user  of  hpcs.  In  essence,  the  exporters  had  to  decide  whether 
a  license  was  required  since  the  decision  is  made  on  the  basis  of  the  end 
use,  the  end  user,  and  the  computer  performance  capability.  This  decision 
could  be  particularly  difficult  for  exports  to  tier  3  countries,  such  as  China, 
where  identifying  the  distinction  between  a  civilian  and  military  end  user 


7pSVs  are  on-site  visits,  generaUy  by  U.S.  government  officials,  to  locations  where  goods  are  shipped. 
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Key  Study  Used  as 
Basis  for  Changing 
HPC  Controls  Had 
Limitations 


can  be  difficult  without  information  that  is  sometimes  available  only  to  the 
U.S.  government.  This  situation  was  partly  reversed  by  the  Fiscal  Year 
1998  National  Defense  Authorization  Act,  which  requires  exporters  to 
notify  the  Commerce  Department  of  all  hpc  sales  over  2,000  mtops  to  tier  3 
coimtries  prior  to  their  export.  Third,  the  regulation  required  hpc 
manufacturers  to  keep  records  of  the  end  users  of  all  their  hpc  exports 
over  2,000  mtops.  To  date,  information  on  these  exports  reported  to  the 
government  has  been  incomplete.  Resporrsibilify  for  psv  checks  remained 
with  the  government.  However,  because  of  how  psvs  for  computers  are 
implemented,  their  value  is  reduced  because  they  verify  the  physical 
location  of  an  hpc,  but  not  how  it  is  used.  Also,  some  governments,  such  as 
China,  have  not  allowed  the  United  States  to  conduct  them. 

With  regard  to  foreign  availability  of  hpcs,®  we  found  that  subsidiaries  of 
U.S.  computer  manufacturers  dominate  the  overseas  hpc  market  and  they 
must  comply  with  U.S.  controls.  Three  Japanese  companies  are  global 
competitors  of  U.S.  manufacturers,  two  of  which  told  us  that  they  had  no 
sales  to  tier  3  cormtries.  The  third  company  did  not  provide  data  on  such 
sales  in  a  format  that  was  usable  for  our  analysis.  Two  of  the  Japanese 
companies  primarily  compete  with  U.S.  manufacturers  for  sales  of 
high-end  hpcs  at  about  20,000  mtops  and  above.  Two  other  manufacturers, 
one  in  Germany  and  one  in  the  United  Kingdom,  also  compete  with  U.S. 
HPC  suppliers,  but  primarily  within  Europe.  Only  the  German  company  has 
sold  HPCS  to  tier  3  countries.  Japan,  Germany,  and  the  United  Kingdom 
each  have  export  controls  on  hpcs  similar  to  those  of  the  United  States, 
according  to  foreign  government  officials.  Russia,  China,  and  India  have 
developed  hpcs,  but  the  capabilities  of  their  computers  are  believed  to  be 
limited.  Thus,  our  analysis  suggests  that  hpcs  over  2,000  mtops  are  not 
readily  available  to  tier  3  countries  from  foreign  sources  without 
restrictions. 


The  Stanford  study,  used  as  a  key  element  by  the  executive  branch  in  its 
decision  to  revise  hpc  export  controls,  had  significant  limitations.  It  lacked 
empirical  evidence  or  analysis  regarding  its  conclusion  that  hpcs  were 
uncontrollable  and,  although  tasked  with  doing  so,  it  did  not  assess  the 
capabilities  of  countries  of  concern  to  use  hpcs  for  military  and  other 
national  security  applications.  The  study  itself  identified  as  a  major 
lirrutation,  its  inability  to  assess  capabilities  of  countries  of  concern  to  use 
HPCS  for  their  military  programs  or  national  security  applications,  on  the 
basis  that  such  information  was  not  available,  and  recommended  that  such 


*We  used  a  description  of  foreign  availability  in  the  Export  Administration  Act  (EAA)  of  1979,  as 
amended,  as  our  criteria. 
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an  assessment  be  done.  The  study  noted  that  trends  in  hpc  technology 
development  could  affect  U.S.  seciuity  and  the  ability  to  control  hpc 
exports  in  the  future  and  need  to  be  further  studied.  Despite  the  study’s 
limitations,  the  executive  branch  decided  to  relax  hpc  export  controls. 


The  Stanford  Study  Lacked 
Evidence  of  HPC 
Uncontrollability 


The  Stanford  study  accmnulated  information  from  computer  companies 
on  U.S.  HPC  market  characteristics  and  concluded — ^without  empirical 
evidence  or  analysis — ^that  computers  between  4,000  and  5,000  mtops  were 
already  available  worldwide  and  uncontrollable  and  that  computers  at 
about  7,000  mtops  would  be  widely  available  and  imcontroUable  by  1997.® 
Using  the  findings  from  the  Stanford  study,  executive  branch  officials  set 
the  computer  performance  control  thresholds  for  each  tier.  However, 
these  officials  could  not  explain  nor  provide  documentation  as  to  how  the 
executive  branch  eirrived  at  the  decision  to  set  the  Ucense  requirements  for 
exports  of  hpcs  to  tier  3  coimtries  for  military  or  proliferation  end  users  at 
2,000  MTOPS,  even  though  the  study  concluded  that  computing  power 
below  4,000  or  5,000  mtops  was  already  “uncontrollable.” 


The  study  identified  the  following  six  factors  as  affecting  controllability  of 
hpcs:  computer  power,  ease  of  upgrading,  physical  size,  numbers  of  umts 
manufactured  and  sold,  sources  of  sales  (direct  sales  or  through  resellers), 
and  the  cost  of  entry  level  systems.  It  described  uncontrollability  as  the 
relationship  between  the  difficulty  of  controlling  computers  and  the 
willingness  of  government  and  industry  to  meet  the  costs  of  tracking  and 
controUing  them.  The  study  asserted  that  as  U.S.  hpcs  were  sold  openly  for 
2  years,  their  export  would  become  imcontrollable.  Part  of  the  study’s 
rationale  was  that,  as  older  hpcs  are  replaced  by  newer  models  2  years 
after  product  introduction,  original  vendors  may  no  longer  have 
information  on  where  replaced  hpcs  are  relocated.  The  study  also 
presumed  a  level  of  “leakage”  of  computers  to  countries  of  concern  from 
U.S.  HPC  sources  and  asserted  that  costs  of  controlling  such  leakage  were 
no  longer  tolerable.  However,  the  study  did  not  attempt  to  calculate  or 
specify  those  costs.  In  addition,  the  study  suggested  only  vague  thresholds 
for  these  six  factors  to  determine  “uncontrollability.”  For  example,  it 
noted  that  the  threshold  at  which  it  becomes  difficult  to  track  numbers  of 
units  could  vary  from  200  to  several  thousand.  The  study  did  not  provide 
analysis  or  empirical  evidence  to  support  its  assumptions  or  conclusions. 


SThe  Commerce  Department  stated  that  Department  of  Defense  (DOD)  information,  which  showed 
that  a  number  of  significant  military  applications  are  run  at  performance  levels  above  7,000  MTOPS, 
also  supported  the  Stanford  study’s  conclusion  that  an  HPC  control  threshold  at  this  level  could  be 
justifiable. 
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National  Security  and 
Proliferation  Risks  of 
HPCs  Not  Assessed 


Although  the  Stanford  study  was  tasked  with  assessing  the  capabilities  of 
countries  of  concern  to  use  hpcs  for  military  and  other  national  secimty 
applications,  it  did  not  do  so.  The  study  discussed  only  U.S.  applications  of 
HPCS  for  military  purposes.  According  to  the  study’s  principal  author,  data 
on  other  coimtries’  use  of  hpcs  for  military  and  other  national  security 
purposes  was  insufficient  to  make  such  assessments  because  the  U.S. 
government  does  not  gather  such  data  in  a  systematic  fashion.  The  report 
recommended  that  such  an  analysis  be  done. 

Despite  the  study’s  limitations  and  recommendations  to  gather  better  data 
in  the  future  on  other  countries’  use  of  hpcs  for  military  and  other  national 
security  pmposes,  the  executive  branch  raised  the  mtops  thresholds  for 
HPC  export  controls  and  established  the  four-tier  export  control  structure. 
The  former  Deputy  Assistant  Secretary  of  Defense  for 
Coimterproliferation  Policy  explained  that  because  dod  was  not  tasked  to 
conduct  a  threat  assessment,  it  did  not  do  so.  Instead,  the  executive 
branch  assessed  coxmtries  on  the  basis  of  six  criteria  and  assigned  them  to 
a  particular  tier.  The  six  criteria  were  (1)  evidence  of  on-going  programs  of 
national  security  concern,  including  proliferation  of  weapons  of  mass 
destruction  with  associated  delivery  systems  and  regional  stability  and 
conventional  threats;  (2)  membership  in  or  adherence  to  non-proliferation 
and  export  control  regimes;  (3)  an  effective  export  control  system, 
including  enforcement  and  compliance  programs  and  an  associated 
assessment  of  diversion  risks;  (4)  overall  relations  with  the  United  States; 
(5)  whether  U.N.  sanctions  had  been  imposed;  and  (6)  prior  licensing 
history. 

Prior  to  the  executive  branch’s  decision  to  change  computer  thresholds, 
scientists  at  Department  of  Energy  (doe)  national  laboratories  and  other 
U.S.  government  officials  had  accumulated  information  to  show  how 
countries  of  concern  could  use  hpcs  to  facilitate  the  design  of  nuclear 
weapons  and  to  improve  advanced  nuclear  weapons  in  the  absence  of 
tests  of  nuclear  explosives.  However,  this  information  was  not  used  as 
part  of  the  decisionmaking  process  for  revising  hpc  export  controls, 
according  to  the  Commerce  Department.  In  December  1997  the  House 
Committee  on  National  Security  directed  the  doe  and  dod  to  assess  the 
national  security  impacts  of  exporting  hpcs  with  performance  levels 
between  2,000  and  7,000  mtops  to  tier  3  coimtries.  In  June  1998, 2  and 
1/2  years  after  the  executive  branch  revised  hpc  export  controls,  doe 
concluded  its  study  on  how  countries  like  China,  India,  and  Pakistan  can 
use  HPCS  to  improve  their  nuclear  programs. 
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According  to  the  doe  study,  the  impact  of  hpc  acquisition  depends  on  the 
complexity  of  the  weapon  being  developed  and,  even  more  importantly,  on 
the  availability  of  high-quality,  relevant  test  data.  The  study  concluded  that 
“the  acquisition  and  application  of  hpcs  to  nuclear  weapons  development 
would  have  the  greatest  potential  impact  on  the  Chinese  nuclear 
program — ^particularly  in  the  event  of  a  ban  on  all  nuclear  weapons 
testing.”  Also,  the  study  indicated  that  India  and  Pakistan  may  now  be  able 
to  make  better  use  of  hpcs  in  the  1,000  to  4,000  mtops  range  for  their 
nuclear  weapons  programs  because  of  the  testing  data  they  acquired  in 
May  1998  from  undergroimd  detonations  of  nuclear  devices.  The  potential 
contribution  to  the  Russian  nuclear  program  is  less  significant  becaiise  of 
its  robust  nuclear  testing  experience,  but  hpcs  can  make  a  contribution  to 
Russia’s  confidence  in  the  reliability  of  its  nuclear  stockpile.  An  emerging 
nuclear  state  is  likely  to  be  able  to  produce  only  rudimentary  nuclear 
weapons  of  comparatively  simple  designs,  for  which  personal  computers 
are  adequate.  We  were  told  that  dod’s  study  of  national  security  impacts 
had  not  been  completed  as  of  September  1, 1998,  in  part  because  the 
Department  had  not  received  requested  information  from  the  Commerce 
Department  until  after  July  1. 


Advances  in  Computing 
Technology  May  Pose 
Long-Term  Security 
Challenges 


The  Stanford  study  noted  that  trends  in  hpc  technology  development  may 
pose  security  and  export  control  challenges  and  recommended  further 
study  to  determine  their  implications  for  national  security  and  export 
controls. 

The  technology  trends  of  concern  include  other  countries’  ability  (1)  to 
upgrade  the  performance  of  individual  computers  and  (2)  to  link 
individual  computers  to  achieve  higher  performance  levels.  The  Stanford 
study  team  reviewed  the  computer  industiy’s  technological  advances  in 
parallel  processing  and  concluded  that  such  advances  as  “scalability”  and 
“clustering”  contributed  to  the  uncontroUability  of  high  performance 
computing  worldwide  and  are  inevitably  reducing  the  effectiveness  of  U.S. 
export  controls.1®  “ScalabUity”  refers  to  the  capabiUty  to  increase 
computer  performance  levels  of  a  system  by  adding  processor  boards  or 
by  acquiring  increasingly  powerful  microprocessors.  “Clustering”  refers  to 
connecting  many  personal  computers  or  workstations  to  achieve  higher 
computing  performance  in  a  network  of  interconnected  systems,  working 
cooperatively  and  concurrently  on  one  or  several  tasks. 


^^Parallel  processing  means  breaking  computational  problems  into  many  separate  parts  and  having  a 
large  number  of  processors  tackle  those  parts  simultaneously.  Greatly  increased  processing  speed  is 
achieved  largely  through  the  sheer  number  of  processors  operating  simultaneously,  rather  than 
through  any  exceptional  power  in  each  processor. 
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Scalability  and  clustering  offer  opportunities  to  increase  computer  power 
without  the  need  to  develop  custom-built  siagle  processors  traditionally 
used  in  hpcs.  Some  types  of  hpcs  are  designed  today  to  allow  scalability 
without  the  need  for  vendor  support  or  even  knowledge.  As  a  result, 
some  HPCS  could  be  exported  below  mtops  thresholds  without  an 
individual  license,  and,  in  theory,  later  covertly  scaled  up  to  levels  that 
exceed  the  threshold.  We  asked  government  agencies  for  information 
about  diversions  and  violations  of  U.S.  hpc  export  controls,  but  they 
provided  no  evidence  that  coimtries  of  concern  have  increased  the 
computing  power  of  U.S.  exported  machines  in  violation  of  export 
restrictions. 

We  found  no  U.S.  government  reviews  of  alternatives  to  address  these 
security  concerns,  although  authors  of  the  Stanford  study  and  others  with 
whom  we  spoke  identified  various  options  that  could  be  assessed.  These 
include  (1)  requiring  government  review  and  consideration  of  machines  at 
their  highest  scalable  mtops  performance  levels  and  (2)  requiring  that  hpcs 
exported  to  tier  3  countries  be  physically  modified  to  prevent  upgrades 
beyond  the  allowed  levels. 


Changes  in  U.S. 
Licensing  and  Export 
Enforcement  Since 
the  Revision 


The  executive  branch’s  January  1996  export  control  revision  (1)  increased 
thresholds  for  requiring  licenses,  which  resulted  in  a  reduction  in  the 
numbers  of  licensed  hpcs;  (2)  shifted  some  of  the  government’s  end-use 
screening  responsibility  from  the  government  to  the  computer  industry, 
until  this  policy  was  revised  in  1998;  and  (3)  required  hpc  manufacturers  to 
keep  records  of  the  end  users  of  their  hpc  exports.  The  government 
continued  to  have  responsibility  for  post-shipment  verifications  for  hpcs, 
which  have  reduced  value  as  traditionally  conducted. 


License  Applications  Have 
Decreased  Since  Revision 


Since  the  export  controls  for  computers  were  revised  in  1996,  hpc  export 
license  applications  have  declined  from  459  applications  in  fiscal  year  1995 
to  125  applications  in  fiscal  year  1997.  In  fiscal  year  1995,  the  Commerce 
Department  approved  395  license  applications  for  hpc  exports,  and  denied 
1.  In  fiscal  year  1997,  Commerce  approved  42  license  applications  for  hpc 
exports,  and  denied  6.  The  remainder  of  the  applications  in  each  year  were 
withdrawn  without  action.  Changes  in  the  numbers  of  both  licensed  and 
unlicensed  exports  might  not  be  attributed  entirely  to  the  change  in  export 
controls.  However,  we  did  note  some  characteristics  of  U.S.  hpc  exports 


“Many  HPC  designs  use  conunercial,  off-the-shelf  processors,  such  as  those  found  in  personal 
computers  or  scientific  workstations,  and  may  include  hundreds  or  even  thousands  of  processors. 
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since  the  revision.  For  example,  while  hpc  exports  increased  to  each  tier 
from  January  1996  through  September  1997,  72  percent  of  machines  were 
sold  to  tier  1  countries.  Also  during  this  period,  77  hpcs  were  exported  to 
China  and  19  were  exported  to  India,  all  without  individual  licenses.  Most 
U.S.  HPCS  exported  in  this  period  (about  85  percent)  had  performance 
levels  between  2,000  and  5,000  mtops.  (See  appendix  III  for  details  on  hpc 
exports.) 


End-Use  Screening 
Responsibility  Shifted  to 
Computer  Industry 


The  executive  branch  shifted  some  government  oversight  responsibility  to 
the  computer  industry,  especially  for  tier  3  countries.  Exporters  became 
responsible  for  determining  whether  exports  required  a  license  by 
screening  end  users  and  end  uses  for  military  or  proliferation  concerns 
(end-use  screening).*^  However,  some  industry  and  government  officials 
concluded  that  the  computer  industry  lacked  the  necessary  information  to 
distinguish  between  military  and  civilian  end  users  in  some  tier  3 
countries — ^particularly  China. 

Because  of  concerns  about  U.S.  hpcs  being  obtained  by  countries  of 
proliferation  concern  for  possible  use  in  weapons-related  activities,  the 
Congress  enacted  a  provision  in  Public  Law  105-85  that  required  exporters 
to  notify  the  Commerce  Department  of  all  proposed  hpc  sales  over 
2,000  MTOPS  to  tier  3  coimtries.  The  law  gives  the  government  an 
opportunity  to  assess  these  exports  within  10  days  to  determine  the  need 
for  a  license  and  it  can  use  information  that  may  not  be  available  to  the 
exporter. 


U.S.  Companies’  Records 
on  Resales  of  HPCs  Are 
Incomplete 


Pursuant  to  the  Export  Administration  Regulations,  exporters  are  required 
to  keep  acciurate  records  of  each  licensed  and  unlicensed  export  of  a 
computer  over  2,000  mtops  to  any  destination.  These  records  are  to  include 
names  and  addresses  of  each  end  user  and  each  “intermediate  consignee” 
(resellers  or  distributors).  Exporters  must  also  provide  quarterly  reports  to 
Commerce  on  license-exempt  exports — ^almost  96  percent  of  the  total  hpc 
exports  in  the  past  2  years. 

The  government  relies  on  the  exporters’  data  for  end-use  information,  but 
we  found  that  companies  had  reported  inconsistent  and  incomplete  data 


aid  exporters  in  making  end  user  determinations,  Commerce  created  specific  guidance  to  educate 
exporters  about  signs  they  need  to  be  aware  of  that  can  be  of  concern  to  the  government.  Companies 
also  were  urged  to  contact  the  Commerce  Department  when  in  doubt  about  an  end  user’s  activities. 
According  to  Commerce,  the  end  user  could  then  be  researched  by  the  government  and  the  exporter 
advised  to  seek  a  license  if  any  strategic  concerns  were  present. 
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for  intermediate  consignees  (resellers  or  distributors)  as  end  users.  For 
example,  one  company  reported  data  for  only  one  intermediate  consignee, 
even  though  company  officials  told  us  that  the  company  uses  multiple 
resellers.  Company  officials  noted  that  the  company  sells  computers  to 
companies  in  other  coimtries,  which  then  sell  the  computers  to  other, 
unknown  end  users.  A  second  company  provided  “end-use  statements” 
from  its  resellers,  rather  than  the  actual  end  users,  and  identified 
computers’  end  use  for  several  overseas  sales  as  “resale.”  In  contrast,  a 
third  company  shows  its  resellers  as  resellers,  rather  than  as  end  users. 
Company  officials  said  that  the  company  contractually  requires  its 
resellers  to  identify  and  provide  end-use  statements  from  the  ultimate 
end-users. 


Safeguards  Procedures  for 
Verifying  the  End  Use  of 
HPCs  Are  Limited 


The  revision  of  hpc  export  controls  did  not  reduce  the  government’s 
responsibility  for  certain  safeguards  procedures,  notably  conducting  psvs, 
Under  current  law.  Commerce  is  required  to  conduct  psvs  for  all  hpc 
exports  over  2,000  mtops  to  tier  3  coxmtries.  While  psvs  are  important  for 
detecting  and  deterring  physical  diversions  of  hpcs,  psvs,  as  traditionally 
conducted,  do  not  verify  computer  end  iise.  Also,  some  countries  do  not 
allow  the  United  States  to  conduct  them.  China,  for  example,  had  not 
allowed  psvs,^^  but  in  June  1998,  it  reportedly  agreed  to  do  so. 


U.S.  government  officials  agreed  that  the  way  psvs  of  computers  have  been 
traditionally  conducted  have  reduced  their  value  because  such  psvs 
establish  only  the  physical  presence  of  an  hpc.  However,  this  step  assures 
the  U.S.  government  that  the  computer  has  not  been  physically  diverted. 
According  to  doe  laboratory  officials,  it  is  easy  to  conceal  how  a  computer 
is  being  used.  They  believed  that  the  U.S.  government  officials  performing 
the  verifications  cannot  make  such  a  determination,  partly  because  they 
have  received  no  computer-specific  training.  Although  it  is  possible  to 
verify  how  an  hpc  is  being  used  through  such  actions  as  reviewing  internal 
computer  data,  this  would  be  costly  and  intrusive,  and  require  experts’ 
sophisticated  computer  analysis. 

Another  limitation  of  psvs  concerns  sovereignty  issues.  Host  governments 
in  some  countries  of  greatest  concern,  notably  China,  have  precluded  or 
restricted  the  U.S.  government’s  ability  to  conduct  psvs.  Three  European 
coimtries  that  we  visited — United  Kingdom,  Germany,  and  France — also 


the  last  3  calendar  years,  U.S  embassy  officials  conducted  20  PSVs  of  digital  computers.  In 
addition,  during  1997,  Commerce  officials  on  special  teams  from  headquarters  also  conducted  19  visits 
to  HPC  locations. 
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do  not  allow  U.S.  government  officials  to  do  psvs.  However,  they  perform 
the  checks  themselves  and  provide  the  results  to  the  U.S.  government. 

The  government  makes  limited  efforts  to  monitor  exporters’  and  end 
users’  compliance  with  explicit  conditions  attached  to  export  licenses.  It 
relies  largely  on  hpc  exporters  for  end  use  monitoring  and  may  require 
them  or  the  end  users  to  safeguard  the  exports  by  limiting  access  to  the 
computers  or  inspecting  computer  logs  and  outputs.  The  end  user  may 
also  be  required  to  agree  to  on-site  inspections,  even  on  short  notice,  by 
U.S.  government  or  exporting  company  officials,  who  would  review 
programs  and  software  used  on  the  computer,  or  to  remote  electronic 
monitoring  of  the  computer.  Commerce  officials  stated  that  they  may  have 
reviewed  computer  logs  in  the  past,  but  do  not  do  so  anymore,  and  said 
that  they  have  not  conducted  any  short  notice  visits,  and  that  they  do  not 
do  remote  monitoring.  They  said  that,  ultimately,  monitoring  safeguards 
plans  is  the  exporter’s  responsibility. 


Current  Foreign 
Availability  of  HPCs 


As  requested,  we  evaluated  the  current  foreign  availability  of  hpcs.  Using 
the  eaa’s  general  description  of  foreign  availability  as  our  criteria,  our 
analysis  showed  that  subsidiaries  of  U.S.  companies  dominate  the 
overseas  sales  of  hpcs.  These  companies  primarily  compete  against  one 
another  with  limited  competition  from  foreign  suppliers  in  Japan  and 
Germany.  We  also  obtained  information  on  the  capability  of  certain  tier  3 
countries  to  build  their  own  hpcs  and  found  it  to  be  limited  in  the 
capability  to  produce  machines  in  comparable  quantity,  quality,  and  power 
as  the  major  HPC-supplier  coimtries. 

The  EAA  describes  foreign  availability  as  goods  or  technology  available 
without  restriction  to  controlled  destinations  from  somces  outside  the 
United  States  in  sufficient  quantities  and  comparable  quality  to  those 
produced  in  the  United  States  so  as  to  render  the  controls  ineffective  in 
achieving  their  purposes.  We  found  that  the  only  global  competitors  for 
general  computer  technology  are  three  Japanese  companies,  two  of  which 
compete  primarily  for  sales  of  high-end  computers — systems  sold  in  small 
volumes  and  performing  at  advanced  levels.  Two  of  the  companies 
reported  no  hpc  exports  to  tier  3  countries,  while  the  third  company 
reported  some  exports  on  a  regional,  rather  than  coimtry,  basis.  One 
German  company  sells  hpcs  primarily  in  Europe  and  has  reported  several 
sales  of  its  hpcs  over  2,000  mtops  to  tier  3  coimtries.  One  British  company 
said  it  is  capable  of  producing  hpcs  above  2,000  mtops,  but  company 
officials  said  it  has  never  sold  a  system  outside  the  European  Union. 
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A 1995  Commerce  Department  study  of  the  hpc  global  market  showed  that 
American  dominance  had  prevailed  at  that  time,  as  well.  The  study 
observed  that  American  hpc  manufacturers  controlled  the  market 
worldwide,  followed  by  Japanese  companies.  It  also  found  that  European 
companies  controlled  about  30  percent  of  the  European  market  and  were 
not  competitive  outside  Europe. 

The  other  countries  that  are  hpc  suppliers  to  coimtries  outside  Europe  also 
restrict  their  exports.  The  United  States  and  Japan  since  1984  have  been 
parties  to  a  bilateral  arrangement,  referred  to  as  the  “Supercomputer 
Regime,”  to  coordinate  their  export  controls  on  hpcs.  Also,  both  Japan^‘‘ 
and  Germany,  like  the  United  States,  are  signatories  to  the  Wassenaar 
Arrangement,  which  has  membership  criteria  of  adherence  to 
non-prohferation  regimes  and  effective  export  controls.^®  Each  country 
also  has  national  regulations  that  generally  appear  to  afford  levels  of 
protection  similar  to  U.S.  regulations  for  their  own  and  for  U.S.-Ucensed 
hpcs.  For  example,  both  coimtries  place  export  controls  on  sales  of 
computers  over  2,000  mtops  to  specified  destinations,  according  to 
German  and  Japanese  government  officials.  However,  foreign  government 
officials  said  that  they  do  not  enforce  U.S.  reexport  controls  on  unlicensed 
U.S.  HPCS.  hi  fact,  a  study  of  German  export  controls  noted  that  regulatory 
provisions  specify  that  Germany  has  no  special  provisions  on  reexport  of 
U.S.-origin  goods.  According  to  German  government  officials,  the  exporter 
is  responsible  for  knowing  the  reexport  requirements  of  the  hpc’s  country 
of  origin.  We  could  not  ascertain  whether  improper  reexports  of  hpcs 
occurred  fi'om  tier  1  countries. 

Because  some  U.S.  government  and  hpc  industry  officials  consider 
indigenous  capability  to  build  hpcs  a  form  of  foreign  availability,  we 
examined  such  capabilities  for  tier  3  countries.  Available  information 
indicates  that  the  capabilities  of  China,  India,  and  Russia  to  build  their 
own  hpcs  still  lag  well  behind  that  of  the  United  States,  Japan,  and 
European  countries.  Although  details  are  not  well-known  about  hpc 
developments  in  each  of  these  tier  3  countries,  most  officials  and  studies 
showed  that  each  country  still  produces  machines  in  small  quantities  and 
of  lower  quality  and  power  compared  to  U.S.,  Japanese,  and  European 
computers.  For  example. 


also  obtained  information  from  the  Japanese  government  and  HPC  vendors.  We  identified 
controls  in  force,  but  did  not  assess  their  implementation. 

^^he  1996  Wassenaar  Arrangement  of  Export  Controls  for  Conventional  Arms  and  Dual-Use  Goods 
and  Technologies  is  an  arrangement  to  exchange  export  information  between  33  states  with  the 
purpose  of  contributing  to  regional  and  international  security  by  enhancing  cooperation  among  export 
control  systems  and  international  regimes. 
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•  China  has  produced  at  least  two  different  types  of  hpcs,  called  the  Galaxy 
and  Dawning  series,  based  on  U.S.  technology  and  they  are  believed  to 
have  a  performance  level  of  about  2,500  mtops.  Although  China  has 
announced  its  latest  Galaxy  at  13,000  mtops,  U.S.  government  officials  have 
no  confirmation  of  this  report. 

•  India  has  produced  a  series  of  computers  called  Param,  which  are  based 
on  U.S.  microprocessors  and  are  believed  by  U.S.  doe  officials  to  be  rated 
at  about  2,000  mtops.  These  officials  were  denied  access  to  test  the 
computer’s  performance. 

•  Russia’s  efforts  over  the  past  three  decades  to  develop  commercially 
viable  hpcs  have  used  both  indigenously-developed  and  U.S. 
microprocessors,  but  have  suffered  from  economic  problems  and  a  lack  of 
customers.  According  to  one  doe  official,  Russia  has  never  built  a 
computer  running  better  than  2,000  mtops,  and  various  observers  believe 
Russia  to  be  3  to  10  years  behind  the  West  in  developing  computers. 


Conclusions 


A  key  element  in  the  1996  decision  to  revise  hpc  export  controls  was  the 
findings  of  the  Stanford  study  which  did  not  have  adequate  analyses  of 
critical  issues.  In  particular,  the  study  used  to  justify  the  decision  did  not 
assemble  empirical  data  or  analysis  to  support  the  conclusion  that  hpcs 
below  specific  performance  levels  were  xmcontroUable  and  widely 
available  worldwide.  Moreover,  the  study  did  not  analyze  the  capabilities 
of  coimtries  of  concern  to  use  hpcs  to  further  their  military  programs  or 
engage  in  nuclear  proliferation,  but  rather  recommended  that  such  data  be 
gathered  and  such  analysis  be  made.  Despite  the  limitations  of  the  study, 
the  executive  branch  revised  the  hpc  export  controls.  Since  the  executive 
branch’s  stated  goals  for  the  revised  hpc  export  controls  included  tailoring 
control  levels  to  security  and  proliferation  risks  of  specific  destinations,  it 
becomes  a  vital  factor  to  determine  how  and  at  what  performance  levels 
specific  coimtries  would  use  hpcs  for  military  and  other  national  security 
applications  and  how  such  uses  would  threaten  U.S.  national  security 
interests  in  specific  areas.  In  addition,  the  Stanford  study  identified  trends 
in  hpc  technology  development  which  may  pose  security  and  export 
control  challenges  for  national  security  and  export  controls.  Some 
alternatives  to  address  these  security  challenges  have  been  identified  by 
authors  of  the  Stanford  study  and  others  with  whom  we  spoke,  and  could 
be  assessed. 


Recommendations 


To  complement  the  studies  undertaken  by  dod  and  doe  for  the  House 
Committee  on  National  Security,  we  recommend  that  the  Secretary  of 
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Defense  assess  and  report  on  the  national  security  threat  and  proliferation 
impact  of  U.S.  exports  of  hpcs  to  countries  of  national  secvulty  and 
proliferation  concern.  This  assessment,  at  a  minimum,  should  address 
(1)  how  and  at  what  performance  levels  coirntries  of  concern  use  hpcs  for 
military  modernization  and  proliferation  activities;  (2)  the  threat  of  such 
uses  to  U.S.  national  security  interests;  and  (3)  the  extent  to  which  such 
HPCS  are  controllable. 

We  also  recommend  that  the  Secretary  of  Commerce,  with  the  support  of 
the  Secretaries  of  Defense,  Energy,  and  State,  and  the  Director  of  the  U.S. 
Arms  Control  and  Disarmament  Agency,  jointly  evaluate  and  report  on 
options  to  safeguard  U.S.  national  security  interests  regarding  hpcs.  Such 
options  should  include,  but  not  be  limited  to,  (1)  requiring  government 
review  and  control  of  the  export  of  computers  at  their  highest  scalable 
MTOPS  performance  levels  and  (2)  requiring  that  hpcs  destined  for  tier  3 
countries  be  physically  modified  to  prevent  upgrades  beyond  the  allowed 
levels. 


Agency  Comments 
and  Our  Evaluation 


Commerce  and  dod  each  provided  one  set  of  general  written  comments  on 
a  draft  of  this  and  a  companion  report^®  and  the  Departments  of  State  and 
Energy  and  the  Arms  Control  and  Disarmament  Agency  provided  oral 
comments.  Commerce,  Defense,  and  State  raised  issues  about  various 
matters  discussed  in  the  report.  The  Department  of  Energy  had  no 
comments  on  the  report  but  said  it  deferred  to  Commerce  and  Defense  to 
comment  on  the  Stanford  study.  The  Arms  Control  and  Disarmament 
Agency  agreed  with  the  substance  of  the  report.  Commerce,  State,  Energy, 
and  the  Arms  Control  and  Disarmament  Agency  did  not  comment  on  omr 
recommendations,  but  Defense  did.  Defense  said  that  our 
recommendation  concerning  the  assessment  of  national  security  threats 
and  proliferation  impact  of  U.S.  exports  to  countries  of  concern  was  done 
in  connection  with  the  1995  decision  to  revise  hpc  export  controls,  and 
that  it  would  consider  additional  options  to  safeguard  exports  of  hpcs  as 
part  of  its  ongoing  review  of  export  controls.  As  noted  below,  we  believe 
the  question  of  how  countries  of  concern  could  use  hpcs  to  further  their 
military  and  nuclear  programs  was  not  addressed  as  part  of  the  executive 
branch’s  1995  decision. 

Commerce  commented  that  the  President’s  decision  was  intended  to 
change  the  computer  export  policy  from  what  it  referred  to  as  “a  relic  of 


^^Export  Controls:  National  Security  Issues  and  Foreign  Availability  for  High  Performance  Computer 
Exports  (GAO/NSIAD-98-200,  September  1998) 
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the  Cold  War  to  one  more  in  tune  with  today’s  technology  and 
international  security  environment.”  Commerce  said  the  decision  was 
based  on  (1)  rapid  technological  changes  in  the  computer  industry, 

(2)  wide  availability,  (3)  limited  controllability,  and  (4)  limited  national 
security  applications  for  hpcs.  Commerce  provided  additional  views  about 
each  of  these  factors.  Commerce  commented  that  our  report  focused  on 
how  countries  might  use  hpcs  for  proliferation  or  military  pxuposes  and  on 
what  it  called  an  outdated  Cold  War  concept  of  “foreign  availability,” 
rather  than  these  factors. 

Our  report  specifically  addresses  the  four  factors  Commerce  said  it 
considered  in  1995.  These  four  factors  are  considered  in  the  Stanford 
University  study  upon  which  the  executive  branch  heavily  relied  in  making 
its  decision  to  revise  hpc  export  controls.  Our  report  agreed  with  the 
study’s  treatment  of  technological  changes  in  the  computing  industry  and 
that  advances  in  computing  technology  may  pose  long-term  security  and 
controllability  challenges. 

Commerce  commented  that  our  analysis  of  foreign  availability  as  an 
element  of  the  controllability  of  hpcs  was  too  narrow,  stating  that  foreign 
availability  is  not  an  adequate  measure  of  the  problem.  Commerce  stated 
that  this  “Cold  War  concept”  makes  little  sense  today,  given  the 
permeability  and  increased  globalization  of  markets.  We  agree  that  rapid 
technological  advancements  in  the  computer  industry  have  made  the 
controllability  of  hpc  exports  a  more  difficult  problem;  however,  we 
disagree  that  foreign  availability  is  an  outdated  Cold  War  concept  that  has 
no  relevance  in  today’s  environment.  While  threats  to  U.S.  security  may 
have  changed,  they  have  not  been  eliminated.  Commerce  itself  recognized 
this  in  its  March  1998  annual  report  to  the  Congress  which  stated  that  “the 
key  to  effective  export  controls  is  setting  control  levels  above  foreign 
availabiUty.”  Moreover,  the  concept  of  foreign  availability,  as  opposed  to 
Commerce’s  notion  of  “worldwide”  availability,  is  still  described  in  eaa  and 
the  Export  Administration  Regulations  as  a  factor  to  be  considered  in 
export  control  policy. 

Commerce  also  commented  that  the  need  to  control  the  export  of  hpcs 
because  of  their  importance  for  national  secuiily  applications  is  limited.  It 
stated  that  many  national  security  applications  can  be  performed 
satisfactorily  on  uncontrollable  low-level  technology,  and  that  computers 
are  not  a  “choke  point”  for  military  production.  Commerce  said  that 
having  access  to  hpcs  alone  will  not  improve  a  cormtiy’s  military-industrial 
capabilities.  Commerce  asserted  that  the  1995  decision  was  based  on 
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research  leading  to  the  conclusion  that  computing  power  is  a  secondary 
consideration  for  many  applications  of  national  security  concern.  We 
asked  Commerce  for  its  research  evidence,  but  none  was  forthcoming.  The 
only  evidence  that  Commerce  cited  was  contained  in  the  Stanford  study. 

Moreover,  Commerce’s  position  on  this  matter  is  not  consistent  with  that 
of  DOD.  DOD,  in  its  Militarily  Critical  Technologies  list,^'^  has  determined 
that  high  performance  computing  is  an  enabling  technology  for  modem 
tactical  and  strategic  warfare  and  is  also  important  in  the  development, 
deployment,  and  use  of  weapons  of  mass  destmction.  High  performance 
computing  has  also  played  a  major  role  in  the  ability  of  the  United  States 
to  maintain  and  increase  the  technological  superiority  of  its  war-fighting 
support  systems,  dod  has  noted  in  its  High  Performance  Computing 
Modernization  Program^®  annual  plan  that  the  use  of  hpc  technology  has 
led  to  lower  costs  for  system  deployment  and  improved  the  effectiveness 
of  complex  weapons  systems,  dod  further  stated  that  as  it  transitions  its 
weapons  system  design  and  test  process  to  rely  more  heavily  on  modeling 
and  simulation,  the  nation  can  expect  many  more  examples  of  the 
profound  effects  that  the  hpc  capability  has  on  both  military  and  civilian 
applications.  Furthermore,  we  note  that  the  concept  of  “choke  point”  is 
not  a  standard  established  in  U.S.  law  or  regulation  for  reviewing  dual-use 
exports  to  sensitive  end  users  for  proliferation  reasons. 

In  its  comments,  dod  said  that  the  Stanford  study  was  just  one  of  many 
sources  of  information  and  analysis  used  in  the  1996  executive  branch 
decision.  We  reviewed  all  of  the  four  sources  of  information  identified  to 
us  by  DOD,  DOE,  State,  Commerce,  and  Arms  Control  and  Disarmament 
Agency  (acda)  officials  as  contributing  to  their  assessment  of  computer 
export  controls.  However,  the  Stanford  study  was  a  key  analytical  study 
used  in  the  decision-making  process  and  the  only  source  whose  findings 
were  consistently  and  repeatedly  cited  by  the  executive  branch  in  official 
announcements,  briefings,  congressional  testimony,  and  discussions  with 
us  in  support  of  the  hpc  e3q)ort  control  revision. 


^■^The  Militarily  Critical  Technologies  List,  required  by  EAA,  is  a  compendium  of  the  technologies  DOD 
assesses  as  critical  to  maintaining  superior  U.S.  military  capabilities.  According  to  DOD,  it  should  be 
used  as  a  reference  for  evaluating  potential  technology  transfers  and  to  determine  if  the  proposed 
transaction  would  permit  potential  adversaries  access  to  technologies  with  specific  performance  levels 
at  or  above  the  characteristics  identified  as  militarily  critical. 

^®The  High  Performance  Computing  Modernization  Program  is  the  msgor  force  designed  to  improve 
DOD’s  ability  to  exploit  the  computation  necessary  to  sustain  technological  superiority  on  the 
battlefield.  Managed  by  the  Director,  Defense  Research  and  Engineering,  the  program  is  intended  to 
establish  a  nationwide  integrated  infi'astructure  to  support  the  defense  research,  development,  test, 
and  evaluation  communities. 


Page  17 


GAO/NSIAD-98-196  Export  Controls 


B-280320 


In  its  comments,  dod  stated  that  our  report  inaccurately  characterized  dod 
as  not  considering  the  threats  associated  with  hpc  exports,  non  said  that  in 
1995  it  “considered”  the  security  risks  associated  with  the  export  of  hpcs 
to  countries  of  national  security  and  proliferation  concern.  What  oxu: 
report  actually  states  is  that  (1)  the  Stanford  study  did  not  assess  the 
capabilities  of  countries  of  concern  to  use  hpcs  for  military  and  other 
national  seciuity  applications,  as  required  by  its  tasking  and  (2)  the 
executive  branch  did  not  undertake  a  threat  analysis  of  providing  hpcs  to 
countries  of  concern,  dod  provided  no  new  documentation  to  demonstrate 
how  it  “considered”  these  risks.  As  the  principal  author  of  the  Stanford 
study  and  dod  officials  stated  during  oin  review,  no  threat  assessment  or 
assessment  of  the  national  secmity  impact  of  allowing  hpcs  to  go  to 
particular  countries  of  concern  and  of  what  military  advantages  such 
coimtries  could  achieve  had  been  done  in  1995.  In  fact,  the  April  1998 
Stanford  study  on  hpc  export  controls  by  the  same  principal  author  also 
noted  that  identifying  which  coimtries  could  use  hpcs  to  pursue  which 
military  applications  remained  a  critical  issue  on  which  the  executive 
branch  provided  little  information. 

In  its  comments,  the  Department  of  State  disagreed  with  our  presenting 
combined  data  on  hpc  exports  to  China  and  Hong  Kong  in  appendix  HI 
because  the  U.S.-Hong  Kong  Policy  Act  of  1992  calls  for  the  U.S. 
government  to  treat  Hong  Kong  as  a  separate  territory  regarding  economic 
and  trade  matters.  While,  in  principle,  we  do  not  disagree  with  State,  it 
should  be  noted  that  we  reported  in  May  1997  that  given  the  decision  to 
continue  current  U.S.  policy  toward  Hong  Kong,  monitoring  various 
indicators  of  Hong  Kong’s  continued  autonomy  in  export  controls 
becomes  critical  to  assessing  the  risk  to  U.S.  nonproliferation  interests. 
Our  presentation  of  the  combined  hpc  export  data  for  China  and  Hong 
Kong  is  intended  to  help  illustrate  a  potential  risk  to  U.S.  nonproliferation 
interests  regarding  hpcs  should  Hong  Kong’s  continued  autonomy  in 
export  controls  be  weakened.  We  believe  that  monitoring  data  on  hpc 
exports  to  Hong  Kong  becomes  aU  the  more  important  since  Hong  Kong  is 
treated  as  a  tier  2  country,  whereas  China  is  a  tier  3  country. 

Commerce  also  provided  technical  comments  which  we  have  incorporated 
as  appropriate.  Commerce  and  dod  written  comments  are  reprinted  in 
appendixes  IV  and  V,  respectively,  along  with  our  evaluation  of  them. 


‘®Hong  Kong’s  Reversion  To  China:  Effective  Monitoring  Critical  to  Assess  U.S.  Nonproliferation  Risks 
(GAO/NSIAD-97-149,  May  1997). 
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ACDA  provided  oral  comments  on  this  report  and  generally  agreed  with  it. 
However,  it  disagreed  with  the  statement  that  “according  to  the  Commerce 
Department,  the  key  to  effective  export  controls  is  setting  control  levels 
above  the  level  of  foreign  availability  of  materials  of  concern.”  acda 
stressed  that  this  is  Commerce’s  position  only  and  not  the  view  of  the 
entire  executive  branch,  acda  said  that  in  its  view  (1)  it  is  difficult  to 
determine  the  foreign  availability  of  hpcs  and  (2)  the  United  States  helps 
create  foreign  availability  through  the  transfer  of  computers  and  computer 
parts. 

Our  scope  and  methodology  are  in  appendix  I.  Appendix  11  contains  details 
on  the  four-tier  system  of  export  controls  and  appendix  HI  shows 
characteristics  of  HPC  exports  since  the  revision. 

We  conducted  our  review  between  August  1997  and  June  1998  in 
accordance  with  generally  accepted  government  auditing  standards. 


We  will  provide  copies  of  this  report  to  other  congressional  committees; 
the  Secretaries  of  Commerce,  Defense,  Energy,  and  State;  the  Director, 
U.S.  Arms  Control  and  Disarmament  Agency;  and  the  Director,  Office  of 
Management  and  Budget.  Copies  will  be  provided  to  others  upon  request 

Please  contact  me  on  (202)  512-4128  if  you  or  your  staff  have  any 
questions  concerning  this  report.  Major  contributors  to  this  report  are 
listed  in  appendix  fV. 

Sincerely  yours. 


Harold  J.  Johnson,  Associate  Director 
International  Relations  and  Trade  Issues 
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To  assess  the  basis  for  the  U.S.  government’s  1996  decision  to  change  hpc 
controls,  we  reviewed  a  1995  Stanford  University  study  on  high 
performance  computing  and  export  control  policy  commissioned  by  the 
Commerce  and  Defense  Departments  and  evaluated  the  executive 
branch’s  assessment  of  national  security  risks  of  hpcs.  We  reviewed 
several  classified  charts  and  briefing  slides  prepared  by  the  intelligence 
community  and  dod  that  were  identified  as  important  support  for  the 
revision  of  controls.  We  also  talked  with  the  Stanford  study’s  principal 
authors  to  discuss  their  methodology,  evidence,  conclusions,  and 
recommendations.  In  addition,  we  met  with  the  Department  of  Defense 
(dod),  the  Department  of  Energy  (doe).  State  and  Commerce  Department 
officials  to  discuss  the  interagency  process  used  leading  up  to  the  decision 
to  revise  controls  on  hpcs.  We  also  requested,  but  were  denied  access  to, 
information  from  the  National  Secmity  Council  on  data  and  analyses  that 
were  used  in  the  interagency  forum  to  reach  the  final  decision  to  revise 
controls. 

To  determine  how  the  government  assessed  the  national  security  risks  of 
allowing  the  high  performance  computers  (hpc)  to  be  provided  to 
countries  of  proliferation  and  military  concern  as  part  of  the  basis  for  the 
decision  to  revise  the  controls,  we  reviewed  dod  and  doe  documents  on 
how  HPCS  are  being  used  for  nuclear  and  nulitaiy  applications.  We 
discussed  high  performance  computing  for  both  U.S.  and  foreign  nuclear 
weapons  programs  with  doe  officials  in  Washington,  D.C.,  and  at  the 
Lawrence  Livermore,  Los  Alamos,  and  Sandia  National  Laboratories.  We 
also  met  with  officials  of  the  dod  hpc  Modernization  Office  and  other 
officials  within  the  Under  Secretary  of  Defense  Acquisition  and 
Technology,  Office  of  the  Secretary  of  Defense,  the  Joint  Chiefs  of  Staff, 
and  the  intelligence  community  to  discuss  how  hpcs  are  being  utilized  for 
weapons  design,  testing  and  evaluation  and  other  military  applications. 
Furthermore,  to  understand  the  trends  occurring  in  computer  technology, 
we  analyzed  hpc  model  descriptions  and  technical  means  for  increasing 
computing  performance. 

To  identify  changes  in  licensing  activities  and  the  implementation  of 
certain  U.S.  licensing  and  export  enforcement  requirements  since  the 
revision: 

•  We  reviewed  two  sets  of  data  firom  the  Commerce  Department,  as  noted 
above,  in  order  to  determine  trends  in  American  hpc  exports  since  the 
1996  revision  of  controls.  We  examined  aU  U.S.  high  performance 
computer-related  license  applications  worldwide.  We  analyzed  the  data  for 
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trends  and  changes  in  mtops  levels  of  hpc  exports  before  and  after  revision 
of  controls,  numbers  of  licenses  approved,  denied,  and  withdrawn  without 
action,  and  hpc  exports  by  coimtries  and  country  tiers.  We  did  not  review 
the  data  for  completeness,  accuracy,  and  consistency. 

•  We  reviewed  the  end  user  and  end-use  screening  systems  of  major 
American  hpc  manufacturers.  Commerce  Department  implementation  of 
the  revised  regulations,  and  selected  foreign  government  export  controls 
in  order  to  determine  licensing  changes  affecting  U.S.  hpc  exporters  since 
the  revision  of  controls.  We  also  reviewed  applicable  U.S.  laws  and 
regulations  governing  hpc  export  hcensing  and  enforcement  and  discussed 
these  laws  and  regulations  with  Commerce  Department  officials.  We 
obtained  Conunerce  Department  procedures  on  end  use  and  end  user 
determinations  as  well  as  records  on  hpc  vendor  inquiries  to  Commerce  on 
end  users.  In  addition,  we  reviewed  information  on  intelligence 
commimity  assessments  of  foreign  end  users  receiving  hpc  exports.  We 
also  discussed  end  user  and  end  use  screening  procedures  with  officials 
from  major  U.S.  hpc  manufacturers — ^Digital  Equipment  Corporation, 
Hewlett  Packard/Convex,  International  Business  Machines,  and  Sun 
Microsystems — ^at  their  corporate  offices  in  the  United  States  and  sales 
offices  overseas.  We  also  visited  representatives  of  these  companies’ 
foreign  subsidiary  offices  from  China,  Germany,  Russia,  Singapore,  South 
Korea,  and  the  United  Kingdom  to  review  end  use  screening  procedures 
and  documentation  for  selected  exports.  In  addition,  we  visited  selected 
HPC  sites  in  China  and  Russia.  However,  the  Chinese  government  refused 
us  permission  to  visit  one  of  three  requested  sites  in  Beijing.  The  Russian 
government,  while  not  denying  us  permission  to  visit  one  site  in-country, 
required  an  extended  period  of  notification  that  went  beyond  our 
timeframes.  Silicon  Graphics,  Inc./Cray  refused  to  meet  with  us  pending 
the  outcome  of  an  ongoing  criminal  investigation. 

•  We  reviewed  Commerce  Department  data  on  pre-license  and 
post-shipment  verification  (psv)  checks  on  hpcs  and  related  technology 
and  safeguards  security  plans  associated  with  hpc  export  licenses  in  order 
to  examine  affects  of  licensing  changes  on  government  oversight.  We 
discussed  the  implementation  and  utility  of  these  checks  with  officials  of 
the  U.S.  government,  American  computer  companies,  and  host 
governments  in  the  countries  we  visited. 

To  determine  foreign  availability  of  hpcs,  we  reviewed  the  Export 
Administration  Act  (eaa)  and  Export  Administration  Regulations  for 
criteria  and  a  description  of  the  meaning  of  the  term.  We  then  reviewed 
market  research  data  from  an  independent  computer  research 
organization.  We  also  reviewed  lists,  brochures,  and  marketing 
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information  from  major  U.S.  and  foreign  hpc  manufacturers  in  France 
(Bull,  SA),  Germany  (Siemens  Nixdorf  Informationssysteme  AG  and 
Parsytec  Computer  GmbH),  and  the  United  Kingdom  (Quadrics 
Supercomputers  World,  Limited)  and  met  with  them  to  discuss  their 
existing  and  projected  product  lines.  We  also  obtained  market  data,  as 
available,  from  three  Japanese  hpc  manufacturers.  Furthermore,  we  met 
with  government  officials  in  China,  France,  Germany,  Singapore,  South 
Korea,  and  the  United  Kingdom  to  discuss  each  country’s  indigenous 
capability  to  produce  hpcs.  We  also  obtained  information  fi-om  the 
Japanese  government  on  its  export  control  policies.  In  addition,  we 
obtained  and  analyzed  from  two  Commerce  Department  databases 
(1)  worldwide  export  licensing  application  data  for  fiscal  years  1994-97 
and  (2)  export  data  from  computer  exporters  provided  to  the  Department 
for  all  American  hpc  exports  between  January  1996  and  October  1997.  We 
also  reviewed  a  1995  Commerce  Department  study  on  the  worldwide 
computer  market  to  identify  foreign  competition  in  the  hpc  market  prior  to 
the  export  control  revision.^  To  identify  similarities  and  differences 
between  U.S.  and  foreign  government  hpc  export  controls,  we  discussed 
with  officials  of  the  U.S.  embassies  and  host  governments  information  on 
foreign  government  export  controls  for  hpcs  and  the  extent  of  cooperation 
between  U.S.  and  host  govermnent  authorities  on  investigations  of  export 
control  violations  and  any  hpc  diversions  of  hpcs  to  sensitive  end  users. 

We  also  reviewed  foreign  government  regulations,  where  available,  and 
both  foreign  govermnent  and  independent  reports  on  each  country’s 
export  control  system. 


^Part  in,  Global  Supercomputer  Industiy  and  Market  Assessment,  June  2, 1995,  Department  of 
Commerce,  Bureau  of  Export  Administration,  Office  of  Strategic  Industries  and  Economic  Security, 
Economic  Analysis  Division 
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Table  III  and  the  description  that  follows  summarize  the  terms  of  the 
revised  export  controls  for  hpcs  and  according  to  their  mtops  levels  and 
destinations. 


Table  11.1:  Current  Export  Licensing  Requirements  for  High  Performance  Computers" 

MTOPS 

Tierl 

Tier  2 

Tiers 

Tier  4 

20,000  and  up 

No  license  required 
under  license  exception'^ 

License  and  additional 
safeguards  may  be 
required 

License  required 

License  required 

Presumption  of  denial 

Various  terrorist  and 
boycott  restrictions  apply 

10,000  to  20,000 

License  required 

up  to  10.  000 

No  license  required 
under  license  exception 

2,000  to  7,000 

License  required  for 
military  or  proliferation 
end  users  or  end  use 

No  license  required  for 
civilian  end  user  under 
license  exception 

Ten-day  review  period 

_  for  government  review _ 

Up  to  2.000  No  license  required  License  required  to 

under  license  exception  Sudan  &  Syria  at  or  over 
6  MTOPS 

and  for  any  MTOPS  to 

_ _ _ rest  of  tier 

^  For  each  tier,  exporters  must  maintain  and  provide  records  to  the  Commerce  Department  and 
reexport  and  retransfer  restrictions  appiy, 

license  exception  for  HPCs  is  a  reguiatory  authorization  that  allows  exporters  to  export  or 
reexport,  based  on  MTOPS  levels  and  destination,  computers  that  otherwise  would  require  a 
license. 


The  Revised  Controls 


The  revised  controls  announced  by  the  President  divide  into  four  countiy 
groups,  as  follows: 


•  Tier  1  (28  countries:  Western  Europe,  Japan,  Canada,  Mexico,  Australia, 
New  Zealand).  No  prior  government  review  (license  exception)  for  all 
computers,  but  companies  must  keep  records  on  higher  performance 
shipments  that  will  be  provided  to  the  U.S.  government,  as  directed. 
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Tier  2  (106  countries:  Latin  America,  South  Korea,  Association  of 
Southeast  Asian  Nations  or  ASEAN,  Hungary,  Poland,  Czech  Republic, 
Slovak  Republic,  Slovenia,  South  Africa).  No  prior  government  review 
(license  exception)  up  to  10,000  mtops  with  record-keeping  and  reporting, 
as  directed;  individual  Ucense  (requiring  prior  government  review)  above 
10,000  MTOPS.  Above  20,000  mtops,  the  government  may  require  certain 
safeguards  at  the  end-user  location. 

Tier  3  (50  coimtries:  India,  Pakistan,  all  Middle  East/Maghreb,  the  former 
Soviet  Union,  China,  Vietnam,  rest  of  Eastern  Europe).  No  prior 
government  review  (Ucense  exception)  up  to  2,000  mtops.  Individual 
Ucense  for  miUtary  and  proUferation-related  end  uses  and  end  users  and 
Ucense  exception  for  civil  end  users  between  2,000  mtops  and  7,000  mtops, 
with  exporter  record-keeping  and  reporting,  as  directed.  Individual  Ucense 
for  aU  end  users  above  7,000  mtops.  Above  10,000  mtops,  additional 
safeguards  may  be  required  at  the  end-user  location. 

Tier  4  (7  countries:  Iraq,  Iran,  Libya,  North  Korea,  Cuba,  Sudan,  and  Syria). 
Current  poUcies  continue  to  apply  (i.e.,  virtual  embargo  on  computer 
exports). 

For  aU  these  groups,  reexport  and  retransfer  provisions  continue  to  apply. 
The  government  continues  to  implement  the  Enhanced  Proliferation 
Control  Initiative,  which  provides  authority  for  the  government  to  block 
exports  of  computers  of  any  level  in  cases  involving  exports  to  end  uses  or 
end  users  of  proliferation  concern  or  risks  of  diversion  to  proliferation 
activities.  Criminal  as  weU  as  civil  penalties  apply  to  violators  of  the 
Initiative. 
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HPC  exports  have  increased  significantly  since  the  1996  export  control 
revision.  Figure  III.l  shows  the  numbers  of  U.S.  hpcs  exported  to  all  tiers 
from  fiscal  year  1994  through  fiscal  year  1997.  In  fiscal  year  1996,  U.S. 
computer  vendors  exported  almost  twice  as  many  hpcs  as  they  had  in 
fiscal  years  1994  and  1995  together.  In  fiscal  year  1997,  U.S.  exports  of 
hpcs  more  than  quadrupled  the  fiscal  year  1996  level.  Figure  in.1  also 
shows  that  growth  in  export  volume  was  strong  for  tier  1  countries. 
Although  tier  2  growth  remained  ahead  of  tier  1  for  the  whole  period,  the 
greatest  volume  of  U.S.  exports  has  been  with  the  tier  1  countries. 

Table  IH.l  shows  the  largest  importers  of  U.S.  hpcs.  U.S.  allies  and  friends 
remained  the  largest  market  for  U.S.  hpc  exports,  but  tier  2  countries  were 
the  fastest  growing  market.  Figure  in.2  summarizes  the  share  of  U.S.  hpc 
exports  that  each  tier  took  in  this  period.  Figure  ni.3  shows  the  top  five 
customers  for  U.S.  hpcs  and  the  portion  of  the  exports  they  received. 
Finally  figure  in.4  shows  that  most  hpcs  exported  in  the  past  2  years  were 
rated  between  2,000  and  3,000  mtops. 
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Figure  III.1 :  Numbers  of  U.S.  High  Performance  Computers  Exported  to  AM  Tiers,  Fiscal  Years  1994  Through  1997 


Note:  This  shows  the  number  of  items  licensed  for  export  rated  at  above  1 ,500  MTOPS  for  fiscal 
years  1994  and  1995,  as  well  as  the  number  of  items  at  or  above  2,000  MTOPS  for  fiscal  years 
1996  and  1997  reported  as  exported.  The  regulations  changed  In  January  1996,  so  that  first 
quarter  fiscal  year  1996  data  includes  HPCs  at  above  1,500  MTOPS  and  the  second  quarter 
includes  18  machines  rated  at  between  1,500  and  2,000  MTOPS  licensed  for  export  in 
January  1996. 
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Since  the  January  1996  revision,  68  coxmtries  worldwide,  out  of  193  in  the 
tier  system,  purchased  3,967  U.S.  hpcs,^  as  of  September  1997.  These 
machines  represent  a  total  hpc  computing  power,  as  calculated  in  mtops,  of 
over  15  million  mtops.  Twenty-six  countries  lead  the  world  as  the  dominant 
customers  for  U.S.  hpcs.  These  countries  purchased  91  percent  of  all  hpcs 
sold  worldwide.  Together  they  purchased  over  14  million  mtops, 
representing  93  percent  of  the  hpc  computing  power  exported  from  the 
U.S.  in  the  period.  Table  in.l  ranks  the  countries  by  the  quantities  of  mtops 
they  purchased.  It  also  shows  the  number  of  hpcs  they  purchased.  The 
countries  that  purchased  the  most  machines  also  purchased  relatively 
more  powerful  machines  as  rated  by  mtops.  (See  table  in.l.) 


^Depending  on  a  personal  computer’s  configuration,  a  PC  with  an  Intel  Pentium  II 350  megahertz  chip 
is  rated  at  408.33  MTOPS.  Each  of  the  3,967  HPC  machines  is  rated  at  least  2,000  MTOPS.  The  3,967 
HPCs  shipped  firom  the  United  States  are  equivalent  to  about  37,000  Pentium  n  computers  in  terms  of 
MTOPs. 
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Table  III.1 :  Largest  Importers  of  U.S. 

HPCs,  Fiscal  Years  1996  - 1997, 

Total  MTOPS 

Ranked  by  Total  MTOPS  Exported 

Total 

Exported  to 

FY96 

FY97 

Machines 

Country 

Country 

Machines 

Machines 

for  FY96-97 

FY96-97  Tier 

Germany 

111 

488 

599 

2,600,949 

1 

United  Kingdom 

87 

489 

576 

2,359,761 

1 

Japan 

74 

233 

307 

1,667,745 

1 

South  Korea 

62 

269 

331 

1,128,945 

2 

France 

29 

229 

258 

1,070,385 

1 

Italy 

16 

142 

158 

601,979 

1 

Switzerland 

23 

147 

170 

500,327 

1 

Spain 

10 

123 

133 

484,862 

1 

Sweden 

20 

77 

97 

441,541 

1 

Australia 

32 

88 

120 

398,198 

1 

Netherlands 

10 

95 

105 

321,352 

1 

Belgium 

12 

88 

100 

288,194 

1 

Hong  Kong 

9 

73 

82 

259,072 

2 

China 

23 

54 

77 

239.037 

3 

Brazil 

2 

68 

70 

214,350 

2 

Israel 

7 

41 

48 

200,177 

3 

Mexico 

12 

45 

57 

199,133 

1 

Malaysia 

23 

53 

76 

194,805 

2 

Singapore 

5 

60 

65 

189,729 

2 

South  Africa 

8 

28 

36 

132,675 

2 

Thailand 

2 

35 

37 

110,536 

2 

Austria 

6 

25 

31 

108,449 

1 

Norway 

1 

15 

16 

107,388 

1 

Indonesia 

0 

27 

27 

91.561 

2 

Russia 

7 

21 

28 

84,961 

3 

Finland 

1 

23 

24 

81,571 

1 

Total 

588 

3,040 

3,628 

14,077,682 

As  table  III.l  shows,  tier  1  countries,  mainly  U.S.  friends  and  allies,  were 
by  far  the  largest  market  for  U.S.  hpcs.  Figure  in.2  summarizes  the  share  of 
U.S.  HPC  exports  that  each  tier  received  in  the  past  2  years. 
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Figure  III.2:  Quantity  and  Percent  of 
U.S.  HPC  Exports  to  Each  Tier, 
January  1996  -September  1997 


Source:  Department  of  Commerce  and  GAO  Analysis. 


Since  the  export  controls  were  revised,  hpcs  have  been  sold  to  more 
coimtries,  but  26  countries  account  for  91  percent  of  all  U.S.  hpcs  sold 
worldwide.  Not  only  have  the  Tier  1  cotmtries  dominated  as  U.S.  hpc 
customers,  five  U.S.  allies  were  the  largest  customers  for  U.S.  hpcs: 
Germany,  the  United  Kingdom,  Japan,  South  Korea,  and  France.  As 
figure  in.3  shows,  these  five  countries  together  received  over  52  percent  of 
the  machines  exported.  These  coimtries  also  bought  the  most  powerful 
machines,  purchasing  58.36  percent  of  the  mtops  exported  in  hpcs. 
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Figure  III.3:  Quantity  and  Percent  of  Total  Machines  Purchased  by  Five  Largest  Customers  for  U.S.  HPCs,  From 
January  1996  -  September  1997 


Remaining  World  1,896  47.8% 


Source:  U.S.  Department  of  Commerce  and  GAO  Analysis. 


The  large  majority  of  U.S.  hpcs  exported  since  the  revision  and  the  largest 
number  of  most  powerful  computers  were  sent  to  tier  1  and  2  countries. 
For  example,  50,  6,  and  1  hpcs  with  computing  power  greater  than 
13,000  MTOPS  went  to  tiers  1, 2,  and  3,  respectively.  Of  the  50  countries  in 
tier  3,  five — China,  Israel,  Russia,  India,  and  Saudi  Arabia — account  for 
about  84  percent  of  the  computers  exported  to  tier  3.  Table  III.2  shows  the 
numbers  of  computers  each  coimtry  has  received. 


Table  III.2:  Numbers  of  Machines 
Exported  to  Top  Five  Tier  3  Recipients, 
January  1996-September  1997^ 


Country 

1996 

1997 

Total 

Percent 
of  total 

China 

23 

54 

77 

35.0 

Israel 

7 

41 

48 

21.8 

Russia 

7 

21 

28 

12.7 

India 

6 

13 

19 

8.6 

Saudi  Arabia 

2 

11 

13 

5.9 

Other  Tier  3 

4 

31 

35 

15.9 

Total 

49 

171 

220 

100 

®HPCs  to  China  and  India  were  exported  with  no  individual  licenses.  Russia  and  Saudi  Arabia 
received  1  licensed  HPC  each,  while  Israel  received  18  licensed  machines. 
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China,  which  ranks  first  in  the  number  of  hpcs  received  by  a  tier  3  country, 
would  have  received  even  higher  numbers  of  hpcs  if  its  hpc  totals  were 
combined  with  those  of  its  Hong  Kong  Special  Administrative  Region. 
Hong  Kong  and  China  rank  13th  and  14th,  respectively,  on  the  hpc 
purchasers’  list.  (See  table  in.1)  If  Hong  Kong  and  China  were  treated  as 
one  for  purposes  of  U.S.  export  controls  and  statistics^,  the  combined 
region  would  have  purchased  more  machines  tiian  Italy,  which  ranked 
seventh  in  U.S.  machines  exported,  and  almost  as  many  machines  as 
Switzerland,  which  ranked  sixth. 

The  largest  numbers  of  U.S.  hpcs  exported  were  less  powerful  hpcs.  hpcs 
at  the  2,000  to  3,000  mtops  level  made  up  the  bulk  of  machines  exported, 
about  58  percent  of  all  hpc  exports,  hpcs  at  the  2,000  to  7,000  mtops  level 
constitute  the  large  majority  of  U.S.  hpc  exports,  about  92  percent  of  all 
U.S.  hpc  exports,  or  3,638  machines  exported.  The  remaining  8  percent  of 
hpc  exports,  329  machines,  were  above  7,000  mtops.  Figure  III.4  shows 
these  relationships.  (See  fig.  in.4.) 


^In  our  report  Hong  Kong’s  Reversion  To  China:  Effective  Monitoring  Critical  to  Assess  U.S. 
Nonproliferation  Risks  (GAO/NSIAB-97-‘149,  May  1997),  we  emphasized  the  need  to  monitor  the 
continuation  of  Hong  Kong's  separate  and  autonomous  export  controls.  U.S.  officials  agreed  that 
monitoring  Hong  Kong’s  autonomy  in  the  conduct  of  export  controls  is  necessary,  given  the  potential 
risks  involved  and  the  U.S.  policy  commitment  to  ensure  that  exports  of  sensitive  technology  to  Hong 
Kong  are  protected. 
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Figure  III.4:  Quantity  and  Percentage  of  U.S.  HPC  Exports  by  MTOPS  Levels,  January  1996-September  1997 


5.000-6,999  MTOPS  268  6.8% 


2,000-2,999  MTOPS  2,310  58.2% 


Source:  U.S.  Department  of  Commerce  and  GAO  analysis. 
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Note:  GAO  comments 
supplementing  those  in  the 
report  text  appear  at  the 
end  of  this  appendix. 


THE  SECRETARY  OF  COMMERCE 

Washington,  D.C.  80S30 

AUG  -7  1998 


Mr.  Harold  J.  Johnson 
Associate  Director 

International  Relations  and  Trade  Issues 
General  Accounting  Office 
Washington,  D.C.  20548 

Dear  Mr.  Johnson: 

Thank  you  for  the  opportunity  to  comment  on  the  draft  GAO  reports  on  the  1995  decision  to 
revise  export  controls  for  high  performance  computers  (HPCs).  My  general  view  is  that  the 
reports  are  too  limited  in  their  scope  and  should  be  expanded  to  reflect  better  the  rationale  that 
led  to  the  President’s  decision  to  change  computer  export  policy  from  a  relic  of  the  Cold  War  to 
one  more  in  tune  with  today’s  technology  and  international  security  environment.  The  President 
based  his  decision  on  several  factors  ~  rapid  technological  change,  wide  availability,  limited 
controllability,  and  limited  national  security  application  ~  that  played  critical  roles  in  the 
Administration’s  decision  to  create  an  effective  export  policy  for  computers  at  various 
performance  levels.  Instead  of  analyzing  this  rationale,  the  reports  focus  on  an  outdated.  Cold 
War  concept  of  "foreign  availability." 

The  United  States  currently  dominates  the  high  performance  computer  market,  in  part  because  of 
the  computer  export  policy  adopted  by  this  Administration  in  1995.  That  policy  was  carefrilly 
crafted  and  was  realistic  in  designating  what  could  be  controlled.  The  1 995  computer  review 
was  a  model  for  how  export  controls  should  be  approached  and  adjusted  in  the  Post-Cold  War 
security  environment.  I  have  provided  recommendations  to  expand  the  reports  and  make  them 
more  reflective  of  this  discussion.  I  ask  that  you  include  the  following  comments  in  your  reports 
and  that  you  consider  our  recommended  changes  to  the  text. 

Thank  you  again  for  soliciting  the  Department’s  views  on  the  draft  reports. 


Enclosures 


Sincerely, 


M.  Daley 
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Comments  and  Recommended  Changes 
GAO  Draft  Report 

^More  Information  Needed  for  Decision  to  Revise  High  Performance  Computer  Controls^’ 
General  Comment 

While  many  factors  contributed  to  the  decision  to  liberalize  export  controls  on  computers,  four 
major  factors  stand  out  ~  technological  progress,  availability,  controllability,  and  the  strategic 
applications  of  high  performance  computers  (HPCs).  Each  of  these  factors  plays  a  critical  role  in 
determining  the  viability  of  imposing  export  controls  on  computers  at  various  computing  levels. 
The  principal  flaw  in  this  study,  and  its  conclusions,  is  its  narrow  and  selective  focus  on 
computer  applications  and  foreign  availability. 

Rapid  Technological  Change 

Four  years  ago,  the  United  Sates  controlled  as  “supercomputers”  machines  with  a  performance 
of  195  millions  of  theoretical  operations  per  second  (MTOPS).  Today,  the  average  personal 
computer  on  a  desk  is  more  powerful.  We  could  not  afford  in  1995  to  ignore  market  trends  and 
technology  advancements  that  were  affecting  the  development  of  computers.  Rapid  progress  in 
microprocessor  architecture  was  a  critical  element.  Improvements  in  microprocessor  design 
made  HPCs  smaller,  cheaper,  and  faster.  Computer  chips  are  produced  in  the  millions  in  plants  in 
the  United  States  and  overseas.  A  1995  report  prepared  by  the  Institute  for  Defense  Analysis  for 
the  Defense  Department  projected  correctly,  based  on  reliable  historical  trends  and  industry 
projections,  that  microprocessor  performance  would  double  by  1 997.  Performance  increases 
were  the  result  of  both  improved  design  and  improved  manufacturing  techniques  that  continue  to 
drive  down  the  prices  of  computers,  making  them  more  affordable  and  more  practical  for  an 
ever-increasing  variety  of  uses.  By  1 995,  rapid  advances  in  microprocessors  and  software  meant 
that  the  performance  levels  once  associated  with  giant  machines  could  be  obtained  by  smaller 
and  relatively  inexpensive  computers  marketed  around  the  world  by  the  tens-of-thousands. 

HPCs  are  smaller,  cheaper,  simpler  to  install  and  maintain,  and  more  reliable.  These  attributes, 
desirable  in  the  marketplace,  constrain  our  ability  to  control  the  export  of  many  HPCs. 

Availability  of  HPCs 

The  GAO  report  focuses  primarily  on  foreign  availability  as  it  relates  to  the  indigenous 
production  capabilities  of  foreign  producers.  This  is  not  an  adequate  measure  of  the  problem. 
Foreign  availability  -  the  availability  of  high  performance  computers  built  by  foreign 
manufacturers  with  foreign  parts  and  technology  -  was  a  key  determinant  of  our  export  policy 
during  the  Cold  War.  A  Cold  War  concept  of  foreign  availability  makes  little  sense  today  in 
determining  policy  for  commodities  like  computers,  given  the  permeability  and  increased 
globalization  of  markets.  Assessments  of  the  global  market  for  computers  in  1995  indicated  that 
roughly  25  percent  of  HPCs  were  sold  outside  the  United  States,  primarily  to  Japan  and  Europe, 
with  a  smaller  percentage  of  exports  targeted  at  East  European,  Asian,  and  Latin  American 
markets.  In  1994  alone,  over  a  half  million  HPCs,  as  they  were  then  defined,  were  sold 
worldwide.  Considering  a  huge  installed  base  of  computers,  we  realized  early  in  our  analysis 
that  requiring  a  license  for  thousands  of  HPCs  would  not  prevent  their  spread. 
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Controllability 

The  feasibility  of  effectively  controlling  items  is  an  important  consideration  in  the  development 
of  export  control  policy.  To  set  controls  in  1995  at  a  level  that  could  not  realistically  be  enforced 
would  have  been  irresponsible  and  hurt  U.S.  industry  when  foreign  suppliers  make  comparable 
products.  This  is  particularly  true  for  systems  below  4,000  MTOPS,  where  European  and 
Japanese  manufacturers  produce  quality  systems  that  can  compete  with  U.S.  companies.  The 
Internet  has  also  complicated  computer  controllability  by  facilitating  the  market  in  used  HPCs 
and  making  remote  access  easy.  Many  Internet  sites  offer  powerftd  HPCs  for  resale.  This 
maricet  is  accessible  to  anyone  throughout  the  world.  Many  of  our  European  allies  do  not 
enforce  U.S.  reexport  controls,  as  they  consider  them  to  be  extraterritorial.  In  light  of  this,  we 
cannot  realistically  expect  to  keep  the  organizations  responsible  for  weapons  development  in 
states  of  concern,  organizations  that  are  technically  sophisticated,  well-fimded  and  which  enjoy 
strong  government  support,  iSrom  clandestinely,  or  even  openly,  obtaining  HPCs  with 
performance  levels  up  to  7,000  MTOPS. 

The  nature  of  the  computer  market  has  strong  implications  for  export  controls,  and  the 
Administration  took  into  account  the  global  availability  of  HPCs  and  their  components  in  our 
assessment  of  those  controls.  The  old  style  HPC,  with  its  extensive  requirements  for  support 
equipment  and  for  maintenance,  was  easily  controllable.  This  is,  however,  not  the  case  for 
modem  HPCs.  We  concluded  in  1995  that  given  the  computers  that  were  then  available 
worldwide  (taking  into  account  computing  power,  scalability,  size,  production  levels,  availability 
of  basic  technologies  and  the  numb^  and  form  of  distribution  channels),  governments  could  not 
effectively  control  the  international  difiusion  of  computing  systems  at  die  licensing  thresholds 
then  in  effect.  These  thresholds  were  far  too  low.  The  1995  decision  to  raise  control  thresholds, 
and  the  thresholds  associated  with  that  decision,  were  thus  based  on  a  realistic  assessment  of  the 
ability  to  control  the  global  distribution  of  computers. 

Applications 

In  1 995,  the  Administration  concluded,  based  on  a  variety  of  research,  that  computer  power  is  a 
secondary  consideration  for  many  applications  of  national  security  concern.  Many  national 
security  applications  can  be  perform^  in  a  satisfactory  manner  based  on  uncontrollable,  low 
level  technology.  In  our  analysis,  countries  of  national  security  concern  cannot  threaten  U.S. 
military  superiority  by  gaining  access  to  HPCs  below  the  levels  defined  by  the  Administration’s 
1995  policy.  The  military  services  identified  only  a  few  high  end  applications  of  concern  in 
developing  the  new  policy.  Information  provided  by  the  Department  of  Defense  as  part  of  the 
1995  policy  review  confirmed  the  conclusion  that  most  military  research  and  development 
applications  require  fewer  than  1,000  MTOPS  of  computational  power.  Performance  levels 
around  1,000  MTOPS  can  be  achieved  with  affordable  computer  systems  widely  available  today. 

Computers  arc  not  a  choke  point  for  military  production.  The  weapon  systems  fmmd  in  the  U.S. 
arsenal  today  —  the  tanks,  airplanes,  weapons,  missiles  and  ships  --  were  designed  and  built  with 
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Now  on  p.  3. 


See  Comment  1 . 
Now  on  p.  4. 


See  comment  1. 
Now  on  p.  4. 


See  comment  1. 
Now  on  p.  4. 


computers  whose  performance  was  below  1,000  MTOPS  ~  in  many  cases  with  only  500 
MTOPS.  These  were  supercomputers  in  the  1980’s,  but  by  1995  one  could  find  single 
microprocessors  that  were  more  powerful,  such  as  the  64-bit  Alpha  EV5,  individually  capable 
of  more  than  700  MTOPS  of  processing  power. 

Having  access  to  high  performance  computers  alone  will  not  provide  improved  military- 
industrial  capabilities.  The  amount  of  computing  power  needed  to  design  and  manufacture 
modem  weapons,  once  one  exceeds  a  few  hundred  MTOPS,  is  not  significant.  Other  factors  -- 
skill  in  software  design,  access  to  sophisticated  manufacturing  techniques,  experience  and  test 
data  in  weapons  design  -  are  much  more  important  than  computer  performance.  The  level  of 
computational  power  used  to  develop  all  the  bombs  in  the  current  U.S.  nuclear  arsenal,  for 
example,  is  less  than  that  found  today  in  many  workstations.  An  HPC  is  only  one  piece  of  the 
puzzle  to  create  a  strategic  weapon.  There  are  many  other  pieces  (e.g.,  knowledge,  skill, 
equipment,  etc.)  that  are  essential  in  the  manufacturing  process. 

Specific  Comments 

Page  4,  line  15.  Amend  to  read:  “...(3)  keeping  records  and  reporting  on  exports  of  computers 
with  performance  levels  of 2,000  MTOPS.  In  addition  to  the  standard  record  keeping 
requirements,  me  regulation  added  record  keeping  requirements  for  the  date  of  shipment,  the 
name  and  address  of  the  end-user  and  of  each  intermcxiiate  consignee,  and  the  end  use  of  each 
exported  computer.” 

Rationale:  Factual. 

Page  6,  line  1 .  Amend  to  read:  “Nonetheless,  based  on  the  worldwide  availability  of  computing 
power  and  in  consideration  of  the  technological  advancements  in  this  area,  the  executive  branch 
raised  the  MTOPS  thresholds  for  HPC  export  controls  and  established  the  four-tier  control 
structure.” 

Rationale:  The  U.S,  Government  had  consistently  referred  to  the  effects  of  technological  trends 
as  being  a  predominant  factor  in  the  decision  to  decontrol  computers. 

Page  6,  line  10.  Amend  to  read:  “First,  the  number  of  computer  export  licenses  issued  declined 
firom  395  in  fiscal  year....” 

Rationale:  Information  about  licensing  statistics  provided  on  page  15  indicates  that  395  refers  to 
licenses  approved  and  not  applications  processed. 

Page  6,  line  15.  Amend  to  read:  decision  is  made  on  the  basis  of  the  end  use,  the  end  user, 
and  the  computer  performance  capability.” 
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See  comment  1. 
Now  on  p.  5. 


See  comment  2. 


Rationale:  Factual. 

Page  6,  line  1 8.  Prior  to  “This  situation...”,  add  new  sentences:  “To  aid  exporters  in  making  end 
user  detenninations,  the  Department  of  Commerce  created  a  specific  list  of  “red  flags”  and 
“know  your  customer”  guidance  to  educate  exporters  about  signs  they  need  to  be  aware  of  that 
can  be  of  concern  to  the  government.  This  guidance  has  been  taught  in  seminars  for  several 
years  and  made  available  on  the  Bureau  of  Export  Administration  web  site.  Companies  were 
also  urged  to  contact  the  Commerce  Department  when  in  doubt  about  an  end  user’s  activities. 

The  end  user  could  then  be  researched  by  the  government  and  the  exporter  advised  to  seek  a 
license  if  any  strategic  concerns  were  present.” 

Rationale:  Although  some  of  the  screening  burden  was  placed  on  the  exporter,  it  was  done  while 
simultaneously  educating  the  public  on  screening  procedures  and  signs  to  be  aware  of.  This  was 
a  tremendous  effort  by  the  Bureau  of  Export  Administration  that  should  not  be  overlooked. 

Page  7,  footnote  8.  Add  "of  1979"  after  "the  Export  Administration  Act"  and  add  the  following 
second  sentence  to  the  footnote:  "Department  of  Commerce  officials  believe  that  this 
determination  is  an  outdated  Cold  War  concept  that  has  little  applicability  in  the  current  world 
environment. 

Page  7,  lined.  Replace  the  first  sentence  of  the  paragraph  with  the  following:  “With  regard 
to  foreign  availability  of  HPCs,  a  number  of  computer  manufacturers  exist  outside  the  United 
States.  In  addition  to  subsidiaries  of  U.S.  computer  manufacturers,  other  manufacturers  are 
located  in  Canada,  Japan,  Europe,  and  Asia.  In  Europe,  Germany,  France,  the  United  Kingdom 
and  Switzerland,  indigenously  manufacture  computers  that  compete  with  those  of  the  United 
States.  In  Asia,  India  is  a  significant  producer  and  capabilities  also  exist  in  Taiwan  and 
Singapore,  where  export  controls  resembling  those  of  the  United  States  do  not  exist. 

It  is  important  to  note,  however,  that  for  proliferators,  the  issue  is  not  a  mass  market  capability  to 
compete  with  U.S.  producers  but  rather  the  capacity  to  make  a  small  number  of  HPCs,  regardless 
of  the  costs,  to  meet  national  needs.  India  is  a  prime  example  of  this  situation.  In  the  late  1980's, 
India  sought  a  HPC  from  the  United  States  but  was  denied  an  export  license.  Bent  on  proving 
that  it  could  still  satisfy  computing  desires  despite  our  refusals,  India  invested  millions  of  dollars 
in  the  creation  of  the  Param  computer.  Although  the  Param  is  not  as  sophisticated  as  U.S, 
computers,  it  can  provide  the  processing  capability  needed  for  weapons  of  mass  destruction 
applications.  After  the  introduction  of  the  Param,  India  publicly  stated  that  it  created  this 
capability  only  after  we  refused  to  sell  the  country  an  HPC  and  in  order  to  evade  our  controls. 

Most  of  the  systems  indigenously  produced  in  Europe  and  Asia  have  computing  powers  that  are 
less  than  5,000  MTOPS  to  target  a  portion  of  the  HPC  market  that  is  large  and  affordable.  The 
Japanese  have  concentrated  on  manufacturing  higher  end  HPCs  that  compete  directly  with  those 
of  the  United  States.  Yet,  for  more  powerfiil  HPCs  over  5,000  MTOPS,  the  United  States 
dominates  the  world  market.  However,  the  threat  of  competition  is  strong  for  lower  end  systems 
below  5,000  MTOPS,  which  provides  some  insight  to  the  types  of  systems  for  which  the  United 
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See  comment  3. 


See  comment  4. 


States  is  most  vulnerable  to  lose  market  share  if  it  is  unable  to  compete  in  the  world  market.  The 
evidence  supports  the  conclusion  that  the  United  States  is  not  a  monopolist  in  this  industry. 
Others  have  ihc  capability  to  produce,  and  will  likely  improve  on  this  capability  if  afforded  the 
opportunity  to  do  so.  This  supports  the  findings  of  foe  1995  Stanford  University  study.” 

Rationale:  Not  enough  attention  is  given  to  foe  existence  of  foreign  producers  that  have  the 
ability  to  produce  high  level  computers  indigenously.  These  systems  are  typically  not  captured 
by  U.S.  controls.  It  is  also  important  to  realize  that  foe  computer  market  is  driven  largely  by 
demand.  If  foe  United  States  does  not  supply  computers  at  satisfactory  levels,  foreign  producers 
will  pick  up  the  slack. 

Page  8,  line  19.  Delete  the  first  sentence  of  foe  2"^  paragraph  and  replace  with  foe  following: 
“The  Stanford  study  accumulated  information  firom  computer  companies  on  U.S.  HPC  market 
characteristics  and  information  fiom  foe  Defense  Department  regarding  national  security 
applications.  This  data  supported  foe  study’s  conclusion  that  a  CTP  threshold  of  7,000  MTOPS 
could  be  justifiable  as  a  point  above  which  a  number  of  significant  strategic  applications  exist” 

Rationale:  Factual.  The  Stanford  University  study  did  not  say  that  computers  at  7,000  MTOPS 
were  uncontrollable.  It  reported  that  computers  at  4,000  -  5,000  MTOPS  were  imcontrollable 
based  on  evidence  of  availability  throughout  the  world. 

Page  II,  line  15.  At  the  end  of  first  paragraph,  add  foe  following:  “This  information  obtained  by 
DOE  laboratories  and  other  U.S.  Government  officials  was  never  provided  to  policy  makers  for 
consideration.  Some  parts  of  DOE,  however,  are  not  in  agreement  regarding  foe  contribution 
that  HPCs  make  to  nuclear  programs  in  countries  of  concern.  This  issue  is  still  under  dispute 
within  DOE.  The  Stanford  University  study  indicated  that  first-generation  nuclear  weapons  can 
successfully  be  designed  using  less  than  1,500  MTOPS.  Although  second-  and  later-generation 
nuclear  weapon  design  requires  more  than  1,500  MTOPS  of  computing  power,  evidence  has 
proven  that  systems  at  this  level  and  higher  are  available  fi-om  foreign  countries  that  do  not 
implement  export  controls  similar  to  those  of  the  United  States.” 

Rationale:  Additional  facts  regarding  this  issue  need  to  be  revealed  to  reflect  this  situation 
accurately. 

Page  19,  line  15.  Add  a  new  2”*  paragraph  as  follows:  “Worldwide  availability  of  computers, 
however,  indicates  there  is  a  large  installed  base  of  systems  with  availability  in  foe  tens  of 
thousands  and  even  millions  for  smaller  systems.  This  complicates  and  severely  limits  the 
ability  of  foe  U.S.  Government  to  control  foe  export  of  all  computers  effectively.  License 
requirements  will  not  prevent  diversion  of  HPCs  unless  realistic  controls  levels  are  set  that  can 
be  enforced  effectively.” 

Rationale:  The  installed  base  of  computers  worldwide  also  plays  an  important  role  in  the 
consideration  of  foe  availability  of  computers  outside  foe  United  States. 
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Page  21,  line  4.  Following ‘U^S.-origm  goods  ”  insert,  “The  United  Kingdom  Government’s 
authorities  instruct  their  exporters  to  ignore  U.S.  reexport  controls.  The  European  Union 
believes  our  reexport  controls  are  extratenitorial  and  therefore  most  EU  coimtries  will  not 
enforce  them.  These  facts  support  the  findings  of  the  Stanford  University  study  with  regard  to 
the  difficulty  of  controlling  computers  effectively  throughout  the  life  of  Ae  product.” 

Rationale:  Factual. 

Page  22,  line  4.  Insert  at  end  of  1**  paragraph  the  following:  “Research  and  information  from 
other  U.S.  Government  sources  and  U.S.  computer  manufacturers  indicate  that  Param  computing 
capabilities  range  from  4,000  MTOPS  to  10,000  MTOPS.” 

Rationale:  Additional  factual  evidence.  The  Param  system  has  been  reported  to  be  more 
powerful  than  the  GAO  report  reveals. 
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The  following  are  gao’s  comments  on  the  Department  of  Commerce  letter 
dated  August  7, 1998.  Commerce  provided  one  set  of  written  comments  for 
this  report.  We  addressed  Commerce’s  general  comments  relevant  to  this 
report  on  page  15  and  its  specific  comments  below. 


GAO  Comments 


1.  We  have  made  the  suggested  changes,  as  appropriate. 

2.  Commerce  also  commented  that  a  number  of  foreign  manufacturers 
indigenously  produce  hpcs  that  compete  with  those  of  the  United  States. 
Evidence  cited  by  Commerce  concerning  particular  countries  with  hpc 
manufacturing  capabilities  came  from  studies  that  were  conducted  in  1996 
and  that  did  not  address  or  use  criteria  related  to  “foreign  availability.”  As 
stated  in  our  report,  we  gathered  data  from  multiple  government  and 
computer  industry  sources  to  find  companies  in  other  countries  that  met 
the  terms  of  foreign  availability.  We  met  with  major  U.S.  hpc  companies  in 
the  United  States,  as  weU  as  with  their  overseas  subsidiaries  in  a  number 
of  countries  we  visited  in  1998,  to  discuss  foreign  hpc  manufacturers  that 
the  U.S.  companies  considered  as  providing  foreign  availability  and 
competition.  We  found  few.  Throughout  Europe  and  Asia,  U.S.  computer 
subsidiary  officials  stated  that  their  competition  is  primarily  other  U.S. 
computer  subsidiaries  and,  to  a  lesser  extent,  Japanese  companies.  Our 
information  does  not  support  Commerce’s  position  on  all  of  these 
manufacturers.  For  example,  our  visit  to  government  and  coitunercial 
sources  in  Singapore  indicated  that  the  country  does  not  now  have  the 
capabilities  to  produce  hpcs.  We  asked  Commerce  to  provide  data  to 
support  its  assertion  on  foreign  manufacturers,  but  we  received  no 
documentary  support.  In  addition,  although  requested.  Commerce  did  not 
provide  documentary  evidence  to  confirm  its  asserted  capabilities  of 
India’s  hpcs  and  uses. 

3.  Commerce  stated  that  policy  makers  did  not  receive  doe  information 
prior  to  the  revision  of  the  hpc  controls  in  1996  and,  further,  there  is 
current  disagreement  within  doe  over  the  contribution  that  hpcs  make  to 
nuclear  programs  in  countries  of  concern.  We  agree  that  Commerce  did 
not  obtain  available  information  on  this  issue  from  doe  laboratories, 
although  such  information  was  available  and  provided  to  us  upon  request. 
In  addition,  we  found  no  dissent  or  qualification  of  views  identified  m 
doe’s  official  study  on  this  matter. 

4.  Commerce  stated  that  worldwide  availability  of  computers  indicates 
that  there  is  a  large  installed  base  of  systems  in  the  tens  of  thousands  or 
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even  millions.  Commerce  further  stated  that  license  requirements  will  not 
prevent  diversion  of  hpcs  unless  realistic  control  levels  are  set  that  can  be 
enforced  effectively.  While  we  agree,  in  principle,  that  increasing  numbers 
of  HPCS  makes  controllability  more  difficult,  a  realistic  assessment  of  when 
an  item  is  “uncontrollable”  would  require  an  analysis  of  (1)  actual  data, 

(2)  estimated  costs  of  enforcing  controls,  and  (3)  pros  and  cons  of 
alternatives — ^such  as  revised  regulatory  procedures — that  might  be 
considered  to  extend  controls.  Such  an  analysis  was  not  done  by  the 
executive  branch  before  its  1995  decision.  In  addition.  Commerce 
provided  no  documentary  evidence  for  its  statement  that  there  is  a  large 
installed  base  of  hpcs  in  the  millions. 

5.  Commerce  stated  that  most  European  governments  do  not  enforce  U.S. 
export  control  restrictions  on  reexport  of  U.S.-supplied  hpcs.  We  agree 
that  at  least  those  European  governments  that  we  visited  (Germany  and 
United  Kingdom)  hold  this  position.  However,  although  requested. 
Commerce  provided  no  evidence  to  support  its  statement  that  the 
government  of  the  United  Kingdom  has  instructed  its  exporters  to  ignore 
U.S.  reexport  controls. 
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Note:  GAO  comments 
supplementing  those  in  the 
report  text  appear  at  the 
end  of  this  appendix. 


See  comment  1. 


See  comment  2. 


See  comment  3. 


DEFENSE  TECHNOLOGY  SECURITY  ADMINISTRATION 
400  AKMY  NAVY  DRIVE.  SUITE  300 
ARLINOTON,  VA  23203-3334 


Mr.  Benjamin  D.  Nelson 
Director,  International  Relations  and  Trade  Issues 
National  Security  and  fetemational  Affairs  Division 
U.S.  Genera]  Accounting  OfSce 
Washington,  D.C.  20548 

Dear  Mr.  Nelson: 

Thank  you  for  the  opportunity  to  connnent  on  the  General  Accounting  Office 
(GAO)  draft  it^rts,  “More  Information  Needed  for  Decision  to  Revise  High 
Perfoimance  Computer  Controls*’  and  '•'Netional  Security  Issues  and  Foreign  Availability 
for  High  Perfonnance  Computer  Exports,”  dated  July  1998  (GAO/NSlAD-PS-l  96  and 
200/OSD  Case  #  1648/1648-A).  The  Department  of  Defense  has  reWewed  the  r^orts 
and  has  the  following  comments: 

•  The  Sunford  University  study  refetred  to  in  the  GAO  report  was  just  one  of 
many  inputs  considered  by  the  Executive  Branch  in  its  1995  assessment  of 
computer  export  controls.  Information  and  analysis  was  also  provided  by 
various  Defense  components  as  well  as  other  USG  agencies,  including  the 
Intelligence  Community. 

•  The  GAO  draft  report  inaccurately  states  that  DoD  did  not  consider  the  threats 
associated  with  high  performance  computer  (HPC)  exports.  DoD  did  take  into 
account- the  security  risks  associated  with  the  export  of  HPCs  to  countries  of  national 
security  and  proliferation  concent.  DoD  identified  numerous  national  security 
applications  tiiat  require  various  levels  of  computing  power,  which  helped  to 
determine  licensing  policies  for  the  various  country  groups  and  to  establish  specific 
safepiar(fc  on  computer  exports.  Countries  ofgreatestnatiOTsl  security  and 
proliferation  concern  are  subject  to  the  most  stringent  licensing  and  safeguard 
requirements. 

•  The  GAO  recommends  that  Ae  Secretary  of  Defense  assess  how  and  at  what 
performance  levels  countries  of  concern  use  HPCs  for  military  modernization  and 
proliferation  activitiw.  These  factors  were  taken  into  account  by  DoD  and  the 
interagency  process  in  Ae  1995  review  of  con^iuter  export  controls,  and  will  be  part 
of  any  ftjture  review.  As  pointed  out  in  fte  Sanford  University  study,  Acre  are  a  wide 
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variety  of  national  security  s^lioatioiis  that  can  benefit  in  one  fonn  or  another  fit>m 
computers  with  performance  levels  well  below  current  thied^olds  for  e^cport  licensing. 
For  example,  the  F-1 17  military  aircraft  was  designed,  developed,  and  produced  u^g 
computers  well  below  500  million  theoretical  operations  per  second.  However,  it  is 
equally  important  to  assess  the  degree  of  controllability  of  conqjuters.  In  the  1995 
computer  export  control  review,  we  determined  that  computers  with  performance 
below  the  current  license  threshold  for  Tier  HI  countries  are  widely  available  globally 
and  are  easily  scalable  so  that  attempts  to  control  ftiem  would  be  ineffective.  In  short, 
the  President  decided  in  1995  on  a  system  of  graduated  controls  that  reflects  both  the 
controllability  of  computers  at  various  thresholds  and  flie  national 
security/proliferation  lishs  for  each  destination. 

•  The  GAO  recommends  that  the  USG  consider  certain  additional  options  to  safeguard 
exports  of  high  performance  computers.  The  Administration  will  be  conducting  a 
review  of  computer  controls  and  these  suggestions  will  be  considered  in  the  course  of 
that  review. 


If  you  have  any  questions,  please  contact  Dr.  Oksana  Nesterezuk  or  Mr*  Richard 
Soskin  of  my  staff  at  (703)  604-8038. 
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The  following  are  gao’s  comments  on  the  Department  of  Defense  letter 
dated  July  16, 1998.  dod  provided  one  set  of  written  comments  for  this 
report.  We  addressed  dod’s  general  comments  relevant  to  this  report  on 
page  17.  We  address  dod’s  specific  comments  below. 


GAO  Comments 


1.  DOD  Stated  that  the  Stanford  study  was  only  one  of  many  inputs 
considered  by  the  executive  branch  in  its  1995  assessment  of  computer 
export  controls.  We  agree,  and  our  report  states,  that  there  were  other 
inputs  to  the  decision.  However,  officials  at  Commerce,  dod.  State,  doe, 
and  ACDA  referred  us  to  the  Stanford  study  in  e3q)laining  the  basis  for  the 
executive  branch  decision  to  revise  the  controls.  Moreover,  in  announcing 
the  1996  HPC  export  control  changes,  the  executive  branch  highlighted  two 
conclusions  of  its  review:  (1)  U.S.-manufactured  computer  technology  up 
to  7,000  MTOPS  would  become  widely  available  worldwide  by  1997  and 

(2)  many  hpc  applications  used  in  U.S.  national  security  programs  occur  at 
or  above  10,000  mtops.  Both  conclusions  were  based  on  information 
provided  only  in  the  Stanford  study.  Also,  dod  provided  briefing  slides  on 
the  HPC  export  control  revision  to  the  House  Committee  on  National 
Security  dated  October  17, 1995,  using  information  drawn  almost 
exclusively  from  the  Stanford  study.  Finally,  a  March  1998  Commerce 
Department  report  on  foreign  policy  export  controls  noted  only  one 
source — a  new  Stanford  study — ^as  part  of  a  1998  review  of  hpc  export 
controls. 

2.  DOD  stated  that  it  identified  numerous  national  security  applications 
used  by  the  United  States  that  require  various  levels  of  computing  power, 
which  helped  to  establish  the  revised  licensing  policies.  We  agree,  and  our 
report  discusses  the  fact  that  dod  identified  how  the  U.S.  government  uses 
HPCs  for  national  security  applications.  However,  this  misses  the  point 
because  these  applications  did  not  refer  to  particular  coimtries  of  concern. 
As  we  noted  in  our  report,  the  principal  author  of  the  Stanford  study  and 
DOD  officials  said  that  they  had  not  performed  a  threat  assessment  or 
analysis  of  other  countries’  use  of  hpcs  for  militaiy  and  other  national 
security  purposes.  The  current  dod  analysis  of  how  countries  of  concern 
can  use  hpcs  is  being  done  at  the  request  of  the  House  National  Security 
Committee  and  might  provide  the  information  needed  to  perform  our 
recommended  assessment. 

3.  We  disagree  that  the  executive  branch  fulfilled  the  intent  of  our 
recommendations.  Specifically,  it  did  not  have  information  on  how  and  at 
what  performance  levels  countries  of  concern,  such  as  China,  India,  and 
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Pakistan,  use  hpcs  for  military  modernization  and  nonnuclear  proliferation 
activities.  Regarding  the  degree  of  controllability  of  computers,  neither  the 
Stanford  study  nor  any  of  the  other  inputs  used  in  the  1995  computer 
export  control  review  provided  any  empirical  evidence  or  analysis  to 
support  assertions  that  hpcs  with  certain  performance  levels  are  widely 
available  and  uncontrollable.  In  fact,  the  1998  Stanford  study  recommends 
procedural  export  licensing  changes  that  would  make  such  hpcs 
controllable  again. 
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The  first  copy  of  each  GAO  report  and  testimony  is  free. 
Additional  copies  are  $2  each.  Orders  should  be  sent  to  the 
following  address,  accompanied  by  a  check  or  money  order 
made  out  to  the  Superintendent  of  Documents,  when 
necessary.  VISA  and  MasterCard  credit  cards  are  accepted,  also. 
Orders  for  100  or  more  copies  to  be  mailed  to  a  single  address 
are  discounted  25  percent. 

Orders  by  mail: 

U.S.  General  Accounting  Office 
P.O.  Box  37050 
Washington,  DC  20013 

or  visit: 

Room  1100 

700  4th  St.  NW  (corner  of  4th  and  G  Sts.  NW) 

U.S.  General  Accounting  Office 
Washington,  DC 

Orders  may  also  be  placed  by  calling  (202)  512-6000 

or  by  using  fax  number  (202)  512-6061,  or  TDD  (202)  512-2537. 

Each  day,  GAO  issues  a  list  of  newly  available  reports  and 
testimony.  To  receive  facsimile  copies  of  the  daily  list  or  any 
list  from  the  past  30  days,  please  call  (202)  512-6000  using  a 
touchtone  phone.  A  recorded  menu  will  provide  information  on 
how  to  obtain  these  lists. 

For  information  on  how  to  access  GAO  reports  on  the  INTERNET, 
send  an  e-mail  message  with  "info"  in  the  body  to: 

info@www.gao.gov 

or  visit  GAO’s  World  Wide  Web  Home  Page  at: 
http://www.gao.gov 
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